# DNS spyware rules by Jack Pepper ( pepperjack@autoshun.org )
# regenerated daily from the domains.txt file at David Glosser's Black hole DNs project
# The URL for BHDNS project:  http://www.malwaredomains.com/files/domains.txt
# The source URL for this   http://www.autoshun.org/downloads/bhdns.rules
#
# A hit on one of these rules indicates is that the dumass user clicked 
# on something shiny, or has spyware installed, or visited a site that 
# tried to do a driveby install.
# 
# Fri, 30 Jul 2010 02:14:01 -0500 
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9speed.info (malware)"; content:"|06|9speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9spice.info (malware)"; content:"|06|9spice|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daxia123.cn (harmful)"; content:"|08|daxia123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deonixion.com (zeus)"; content:"|09|deonixion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostads.cn (malware)"; content:"|07|hostads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiruassu.cn (zeus)"; content:"|08|kiruassu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutalot.cn (zeus)"; content:"|07|cutalot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electronicssense-search.com (zeus)"; content:"|17|electronicssense-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flo4.biz (harmful)"; content:"|04|flo4|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg2a.info (malware)"; content:"|04|mg2a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg3a.info (malware)"; content:"|04|mg3a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg4a.info (malware)"; content:"|04|mg4a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg5a.info (malware)"; content:"|04|mg5a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg6a.info (malware)"; content:"|04|mg6a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg7a.info (malware)"; content:"|04|mg7a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg8a.info (malware)"; content:"|04|mg8a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg9a.info (malware)"; content:"|04|mg9a|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywatermakrs.cn (scareware)"; content:"|0c|mywatermakrs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newadmins.ws (zeus)"; content:"|09|newadmins|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup no-spyware-thanks.com (scareware)"; content:"|11|no-spyware-thanks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nothern-ireland.cn (scareware)"; content:"|0f|nothern-ireland|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuwofteuz.com (scareware)"; content:"|09|nuwofteuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-pro-scanner.com (malware)"; content:"|12|online-pro-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinebestscannerv3.com (malware)"; content:"|13|onlinebestscannerv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinepersonalscanner.com (scareware)"; content:"|15|onlinepersonalscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineproantivirusscan.com (scareware)"; content:"|16|onlineproantivirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineproantivirusscanner.com (scareware)"; content:"|19|onlineproantivirusscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineproscan.com (scareware)"; content:"|0d|onlineproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurescannerv3.com (scareware)"; content:"|15|onlinesecurescannerv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pop0p.cn (malware)"; content:"|05|pop0p|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39t.ru (malware)"; content:"|03|39t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39v.ru (malware)"; content:"|03|39v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bf.ru (malware)"; content:"|03|3bf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azginkizlar.net (malware)"; content:"|0b|azginkizlar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidupn.cn (malware)"; content:"|07|baidupn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delawarepokernews.com (malware)"; content:"|11|delawarepokernews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denizlisurucukursu.com.tr (malware)"; content:"|12|denizlisurucukursu|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detkreativeselskab.dk (malware)"; content:"|12|detkreativeselskab|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalbillnow.com (rogue)"; content:"|0e|digitalbillnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadsoftwareserver4.com (malware)"; content:"|17|downloadsoftwareserver4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxjyh.com (malware)"; content:"|05|dxjyh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekrclean.info (malware)"; content:"|08|ekrclean|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup errorkillers.net (malware)"; content:"|0c|errorkillers|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escolademusicaliverpool.com.br (malware)"; content:"|17|escolademusicaliverpool|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exeeasy.com (malware)"; content:"|07|exeeasy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exesmooth.com (malware)"; content:"|09|exesmooth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastvirusscanv6.com (rogue)"; content:"|0f|fastvirusscanv6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fell4u.com (malware)"; content:"|06|fell4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileden.com (malware)"; content:"|07|fileden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileexess.com (malware)"; content:"|09|fileexess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowersagents.com (malware)"; content:"|0d|flowersagents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup for.caucasus.net (malware)"; content:"|03|for|08|caucasus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.sleptonmusic.com (malware)"; content:"|05|forum|0c|sleptonmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxsrl.net (malware)"; content:"|06|foxsrl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-security-software.com (malware)"; content:"|16|free-security-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedmans.com (malware)"; content:"|09|freedmans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fx-chat.com (malware)"; content:"|07|fx-chat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fx-news.ru (malware)"; content:"|07|fx-news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaehh.info (malware)"; content:"|05|gaehh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ganionasetugav.com (malware)"; content:"|0e|ganionasetugav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gersoft.info (malware)"; content:"|07|gersoft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-files-now.info (malware)"; content:"|0d|get-files-now|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfrjk.cn (malware)"; content:"|05|gfrjk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glavnij20090809.com (malware)"; content:"|0f|glavnij20090809|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gluebert.de (malware)"; content:"|08|gluebert|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gofastscanner.com (malware)"; content:"|0d|gofastscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomalwarescanner.com (malware)"; content:"|10|gomalwarescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorbaritosaona.com (malware)"; content:"|0e|gorbaritosaona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groiut.cn (malware)"; content:"|06|groiut|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guidetogalaxy.cn (malware)"; content:"|0d|guidetogalaxy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1.ripway.com (malware)"; content:"|02|h1|06|ripway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1t3m.org (malware)"; content:"|05|h1t3m|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hagnuor.cn (malware)"; content:"|07|hagnuor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hannegirls.ms.kr (malware)"; content:"|0a|hannegirls|02|ms|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hao8.idckj.com (malware)"; content:"|04|hao8|05|idckj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hbeykbdve.com (malware)"; content:"|09|hbeykbdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hisarkitabevi.com (malware)"; content:"|0d|hisarkitabevi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeantispywarescan.com (malware)"; content:"|13|homeantispywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotlife.us (malware)"; content:"|07|hotlife|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotshows.org (malware)"; content:"|08|hotshows|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htsrh.info (malware)"; content:"|05|htsrh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetfoto.se (malware)"; content:"|0c|internetfoto|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investment.kg (malware)"; content:"|0a|investment|02|kg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipsalamyo.trakya.edu.tr (malware)"; content:"|09|ipsalamyo|06|trakya|03|edu|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ispask.cn (malware)"; content:"|06|ispask|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javastat.cn (malware)"; content:"|08|javastat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jesusville.co.kr (malware)"; content:"|0a|jesusville|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsguangji.cn (malware)"; content:"|09|jsguangji|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jssalt.gov.cn (malware)"; content:"|06|jssalt|03|gov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup june-crossover.com (malware)"; content:"|0e|june-crossover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanpurmart.com (malware)"; content:"|0a|kanpurmart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keyboard-mouse-fun.com (malware)"; content:"|12|keyboard-mouse-fun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kilerodik.com (malware)"; content:"|09|kilerodik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingpinservers.info (malware)"; content:"|0e|kingpinservers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirosi.com (malware)"; content:"|06|kirosi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komalinovskatas.com (malware)"; content:"|0f|komalinovskatas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpeoplepower21.org (malware)"; content:"|0e|kpeoplepower21|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ksxwa.com (malware)"; content:"|05|ksxwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacabane.be (malware)"; content:"|08|lacabane|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latinintel-tc.com (malware)"; content:"|0d|latinintel-tc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lead-trix.com (malware)"; content:"|09|lead-trix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesex.xpg.com.br (malware)"; content:"|07|livesex|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolkabernadofa.com (malware)"; content:"|0e|lolkabernadofa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luckystats.org (malware)"; content:"|0a|luckystats|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luckystats1.com (malware)"; content:"|0b|luckystats1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxherbal.com (malware)"; content:"|09|luxherbal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maiami.123laptop.net (malware)"; content:"|06|maiami|09|123laptop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediamagnats.com (malware)"; content:"|0c|mediamagnats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medisite.fr (malware)"; content:"|08|medisite|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mishkigammy-060809.com (malware)"; content:"|12|mishkigammy-060809|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mistresslorisdungeon.com (malware)"; content:"|14|mistresslorisdungeon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnm.co.tz (malware)"; content:"|03|mnm|02|co|02|tz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monsterr.biz (malware)"; content:"|08|monsterr|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mooshooh.info (malware)"; content:"|08|mooshooh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mstsc2005.com (malware)"; content:"|09|mstsc2005|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysafecomputerscan.com (rogue)"; content:"|12|mysafecomputerscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neatsore.info (malware)"; content:"|08|neatsore|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netcom3.com (malware)"; content:"|07|netcom3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextantivirusplus.com (malware)"; content:"|11|nextantivirusplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nkwxs.com (malware)"; content:"|05|nkwxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nucleargaming.net (malware)"; content:"|0d|nucleargaming|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nulermagolasenda.com (malware)"; content:"|10|nulermagolasenda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obituraneskov.com (malware)"; content:"|0d|obituraneskov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obyz.de (malware)"; content:"|04|obyz|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ochak.com (malware)"; content:"|05|ochak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olafeskanotiro.com (malware)"; content:"|0e|olafeskanotiro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-best-scanv3.com (rogue)"; content:"|12|online-best-scanv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-defenderv9.com (rogue)"; content:"|11|online-defenderv9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-secure-scannerv2.com (rogue)"; content:"|17|online-secure-scannerv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-secure-scanv7.com (rogue)"; content:"|14|online-secure-scanv7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineinternetpayments.com (malware)"; content:"|16|onlineinternetpayments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinewebsupport.net (rogue)"; content:"|10|onlinewebsupport|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oplanet.info (malware)"; content:"|07|oplanet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovkanubergan.com (threat)"; content:"|0c|ovkanubergan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-antispy-scanv3.com (rogue)"; content:"|16|premium-antispy-scanv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-antispy-scanv7.com (rogue)"; content:"|16|premium-antispy-scanv7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup private-antivirus-scannerv2.com (rogue)"; content:"|1b|private-antivirus-scannerv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rlproject.xpg.com.br (malware)"; content:"|09|rlproject|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roxd.altervista.org (malware)"; content:"|04|roxd|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safebilling-2.com (malware)"; content:"|0d|safebilling-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safeonlinescanv4.com (rogue)"; content:"|10|safeonlinescanv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanagustin.edu.bo (malware)"; content:"|0a|sanagustin|03|edu|02|bo"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-for-threats.info (malware)"; content:"|10|scan-for-threats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-antispyware-scanv3.com (rogue)"; content:"|19|secure-antispyware-scanv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-spyware-scannerv3.com (rogue)"; content:"|18|secure-spyware-scannerv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-virus-scannerv5.com (rogue)"; content:"|16|secure-virus-scannerv5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepersonalscanner.com (rogue)"; content:"|15|securepersonalscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityfolderprotection.com (rogue)"; content:"|18|securityfolderprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seno.cz (malware)"; content:"|04|seno|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serversafety.com (malware)"; content:"|0c|serversafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup signupsystem.com (malware)"; content:"|0c|signupsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simpsontrainingsolutions.com (malware)"; content:"|18|simpsontrainingsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinomedical.cn (malware)"; content:"|0b|sinomedical|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siroamorello.com (malware)"; content:"|0c|siroamorello|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siyou.org.cn (malware)"; content:"|05|siyou|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sj1j1.cn (malware)"; content:"|05|sj1j1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ska.energia.cz (malware)"; content:"|03|ska|07|energia|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sleave.info (malware)"; content:"|06|sleave|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snyder.esc14.net (malware)"; content:"|06|snyder|05|esc14|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sobakaikorova.com (malware)"; content:"|0d|sobakaikorova|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socks5service.cn (malware)"; content:"|0d|socks5service|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareaddonsuploadv3.com (malware)"; content:"|16|softwareaddonsuploadv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-scannerv2.com (rogue)"; content:"|11|spyware-scannerv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarescannerv4.com (rogue)"; content:"|10|spywarescannerv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportnetcenter.com (rogue)"; content:"|10|supportnetcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemsecuritysite.com (rogue)"; content:"|12|systemsecuritysite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ue4x08f5myqdl.cn (harmful)"; content:"|0d|ue4x08f5myqdl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusonlinescanv3.com (rogue)"; content:"|11|virusonlinescanv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10gala.com (malware)"; content:"|06|10gala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autousbestsellers.com (malware)"; content:"|11|autousbestsellers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bauzon.ph (malware)"; content:"|06|bauzon|02|ph"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhalive.net (malware)"; content:"|07|bhalive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boobsgirl.cn (malware)"; content:"|09|boobsgirl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsidiket.cn (malware)"; content:"|08|bsidiket|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessdatacenter.biz (malware)"; content:"|12|businessdatacenter|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ce5.at (malware)"; content:"|03|ce5|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkrecentupdates.com (malware)"; content:"|12|checkrecentupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-pc-now.info (malware)"; content:"|0c|clean-pc-now|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codex-engine.cn (malware)"; content:"|0c|codex-engine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djstevyvee.com (malware)"; content:"|0a|djstevyvee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dopxk.com (malware)"; content:"|05|dopxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr3.com (malware)"; content:"|0c|downloadavr3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwlsoft.com (malware)"; content:"|07|dwlsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entrust-groupli.cc (malware)"; content:"|0f|entrust-groupli|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entrustgroup.cn (malware)"; content:"|0c|entrustgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fordearfriends.com (malware)"; content:"|0e|fordearfriends|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-tube-orgasm.com (malware)"; content:"|10|free-tube-orgasm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold-service.ru (malware)"; content:"|0c|gold-service|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gombely.cn (malware)"; content:"|07|gombely|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot2009.net (malware)"; content:"|07|hot2009|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igouhxe.cn (malware)"; content:"|07|igouhxe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iguyzmo.cn (malware)"; content:"|07|iguyzmo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mouse-on-mars.com (malware)"; content:"|0d|mouse-on-mars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n.99081.com (harmful)"; content:"|01|n|05|99081|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news.orangepussy.cn (malware)"; content:"|04|news|0b|orangepussy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nothing-to-wear.cn (malware)"; content:"|0f|nothing-to-wear|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns-free-acc7.com (malware)"; content:"|0c|ns-free-acc7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup o.99081.com (harmful)"; content:"|01|o|05|99081|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reglet.info (harmful)"; content:"|06|reglet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s2kill.com (malware)"; content:"|06|s2kill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scope-group.cc (malware)"; content:"|0b|scope-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scope-group.cn (malware)"; content:"|0b|scope-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scope-groupmain.cc (malware)"; content:"|0f|scope-groupmain|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scope-groupmain.cn (malware)"; content:"|0f|scope-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shipal.eu (malware)"; content:"|06|shipal|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sibble.info (malware)"; content:"|06|sibble|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup velikan.cn (malware)"; content:"|07|velikan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidscollect.info (malware)"; content:"|0b|vidscollect|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waztuok.cn (malware)"; content:"|07|waztuok|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webscansecurepc.com (malware)"; content:"|0f|webscansecurepc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winagreatprizetoday.com (malware)"; content:"|13|winagreatprizetoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zerowestor.com (malware)"; content:"|0a|zerowestor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39b.ru (harmful)"; content:"|03|39b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39j.ru (harmful)"; content:"|03|39j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39q.ru (iframe)"; content:"|03|39q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bh.ru (harmful)"; content:"|03|3bh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bj.ru (harmful)"; content:"|03|3bj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bq.ru (malware)"; content:"|03|3bq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3c7.ru (malware)"; content:"|03|3c7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3c8.ru (harmful)"; content:"|03|3c8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3c9.ru (harmful)"; content:"|03|3c9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ca.ru (malware)"; content:"|03|3ca|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cf.ru (malware)"; content:"|03|3cf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ci.ru (malware)"; content:"|03|3ci|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cl.ru (harmful)"; content:"|03|3cl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cq.ru (malware)"; content:"|03|3cq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cw.ru (malware)"; content:"|03|3cw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3cy.ru (harmful)"; content:"|03|3cy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3e0.ru (harmful)"; content:"|03|3e0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3eq.ru (malware)"; content:"|03|3eq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ew.ru (harmful)"; content:"|03|3ew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f0.ru (malware)"; content:"|03|3f0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f2.ru (harmful)"; content:"|03|3f2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f4.ru (malware)"; content:"|03|3f4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f6.ru (malware)"; content:"|03|3f6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f7.ru (malware)"; content:"|03|3f7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f8.ru (malware)"; content:"|03|3f8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3f9.ru (malware)"; content:"|03|3f9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3fb.ru (malware)"; content:"|03|3fb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3god.net (malware)"; content:"|04|3god|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6w2.ru (malware)"; content:"|03|6w2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3j.ru (malware)"; content:"|03|a3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5f.ru (malware)"; content:"|03|a5f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5g.at (malware)"; content:"|03|a5g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5g.ru (iframe)"; content:"|03|a5g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5h.ru (iframe)"; content:"|03|a5h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5i.ru (iframe)"; content:"|03|a5i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5j.ru (iframe)"; content:"|03|a5j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agodaynsbert.com (malware)"; content:"|0c|agodaynsbert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aj4.ru (malware)"; content:"|03|aj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alertonabert.com (malware)"; content:"|0c|alertonabert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alionerkilo.com (malware)"; content:"|0b|alionerkilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b3a.ru (malware)"; content:"|03|b3a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfilmlife.cn (iframe)"; content:"|0c|bestfilmlife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandnameshoppin.cn (iframe)"; content:"|10|brandnameshoppin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulakeskatorad.com (malware)"; content:"|0e|bulakeskatorad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c3q.ru (harmful)"; content:"|03|c3q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c5e.ru (harmful)"; content:"|03|c5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c5y.ru (harmful)"; content:"|03|c5y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6h.ru (malware)"; content:"|03|c6h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6p.at (malware)"; content:"|03|c6p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6p.ru (malware)"; content:"|03|c6p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6y.ru (iframe)"; content:"|03|c6y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7h.ru (iframe)"; content:"|03|c7h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8b.at (malware)"; content:"|03|c8b|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup car963.info (sql_injection)"; content:"|06|car963|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ce5.ru (malware)"; content:"|03|ce5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citi-unlock.com (phishing)"; content:"|0b|citi-unlock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-all-spyware.com (malware)"; content:"|11|clean-all-spyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolvideoss.com (fake_codec)"; content:"|0b|coolvideoss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customer.krypt.com (sql_injection)"; content:"|08|customer|05|krypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dealsplanet.info (rogue)"; content:"|0b|dealsplanet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evideofreak.com (fake_codec)"; content:"|0b|evideofreak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fetuchinioskajera.com (malware)"; content:"|11|fetuchinioskajera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup franchjump.ru (garmful)"; content:"|0a|franchjump|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fredekulipo.com (malware)"; content:"|0b|fredekulipo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamecj.com (sql_injection)"; content:"|06|gamecj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getyoursecuritynowv2.com (malware)"; content:"|14|getyoursecuritynowv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gncr.org (malware)"; content:"|04|gncr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup granata282.cn (malware)"; content:"|0a|granata282|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guliopalektori.com (malware)"; content:"|0e|guliopalektori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdvideoforums.org (malware)"; content:"|0d|hdvideoforums|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hi8.ss.la (malware)"; content:"|03|hi8|02|ss|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidevideozz.com (fake_codec)"; content:"|0b|hidevideozz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hihanin.com (malware)"; content:"|07|hihanin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugebestbuy.cn (malware)"; content:"|0b|hugebestbuy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iicon-metal.org (worm)"; content:"|0b|iicon-metal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innovavids.com (fake_codec)"; content:"|0a|innovavids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julionermon.com (malware)"; content:"|0b|julionermon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingfamilyphotoalbum.com (malware)"; content:"|14|kingfamilyphotoalbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likaraoke.com (malware)"; content:"|09|likaraoke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzwn.in (malware)"; content:"|04|lzwn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mactep.org (malware)"; content:"|06|mactep|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magic4you.nu (malware)"; content:"|09|magic4you|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marbling.pe.kr (malware)"; content:"|08|marbling|02|pe|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mx081.braqsil.com (rogue)"; content:"|05|mx081|07|braqsil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nacjalneg.info (malware)"; content:"|09|nacjalneg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhaej.com (sql_injection)"; content:"|05|nhaej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrefadoskfer.com (malware)"; content:"|0c|nrefadoskfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oaty.in (malware)"; content:"|04|oaty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onagerfadusak.com (malware)"; content:"|0d|onagerfadusak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online358.net (malware)"; content:"|09|online358|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovuioipolak.com (malware)"; content:"|0b|ovuioipolak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradisios.com (fake_codec)"; content:"|0a|paradisios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentvirusmelt.cn (malware)"; content:"|10|paymentvirusmelt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pebernufeska.com (malware)"; content:"|0c|pebernufeska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntubxxx.com (fake_codec)"; content:"|0a|porntubxxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prestotunerst.cn (malware)"; content:"|0d|prestotunerst|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pronline.ru (malware)"; content:"|08|pronline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purplehoodie.com (malware)"; content:"|0c|purplehoodie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvideoguide.org (fake_codec)"; content:"|0b|pvideoguide|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0a.ru (iframe)"; content:"|03|q0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0c.ru (iframe)"; content:"|03|q0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0i.ru (malware)"; content:"|03|q0i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0k.ru (malware)"; content:"|03|q0k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0l.ru (iframe)"; content:"|03|q0l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0u.ru (malware)"; content:"|03|q0u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0x.ru (malware)"; content:"|03|q0x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1b.ru (iframe)"; content:"|03|q1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1d.ru (malware)"; content:"|03|q1d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1k.in (malware)"; content:"|03|q1k|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsng.cn (malware)"; content:"|04|qsng|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualivids.com (fake_codec)"; content:"|09|qualivids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reliable007.com (fake_codec)"; content:"|0b|reliable007|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ridebullet.com (malware)"; content:"|0a|ridebullet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetywirelessonline.com (rogue)"; content:"|14|safetywirelessonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityscaninternet.com (rogue)"; content:"|14|securityscaninternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsite.com (rogue)"; content:"|10|securitytoolsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seksburada.net (malware)"; content:"|0a|seksburada|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopfilmworld.cn (malware)"; content:"|0d|shopfilmworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoponlinefilmsite.cn (malware)"; content:"|12|shoponlinefilmsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoppicturelife.cn (malware)"; content:"|0f|shoppicturelife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportsmansclub.net (malware)"; content:"|0e|sportsmansclub|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stock888.cn (malware)"; content:"|08|stock888|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tarhujelafert.com (malware)"; content:"|0d|tarhujelafert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tathli.com (malware)"; content:"|06|tathli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamclouds.com (malware)"; content:"|0a|teamclouds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup texaswhitetailfever.com (malware)"; content:"|13|texaswhitetailfever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tramadolspace.ru (harmful)"; content:"|0d|tramadolspace|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trobanionads.com (malware)"; content:"|0c|trobanionads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuhytalerf.com (malware)"; content:"|0a|tuhytalerf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wadefamilytree.org (malware)"; content:"|0e|wadefamilytree|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8l.in (iframe)"; content:"|03|x8l|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8l.ru (malware)"; content:"|03|x8l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8m.ru (iframe)"; content:"|03|x8m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8n.ru (iframe)"; content:"|03|x8n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8o.ru (iframe)"; content:"|03|x8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8u.in (iframe)"; content:"|03|x8u|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8u.ru (malware)"; content:"|03|x8u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8v.ru (iframe)"; content:"|03|x8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8w.ru (malware)"; content:"|03|x8w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9d.in (iframe)"; content:"|03|x9d|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9o.ru (iframe)"; content:"|03|x9o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9p.ru (malware)"; content:"|03|x9p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xh3.ru (malware)"; content:"|03|xh3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xh4.ru (malware)"; content:"|03|xh4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xh9.in (iframe)"; content:"|03|xh9|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xi3.ru (iframe)"; content:"|03|xi3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xj5.ru (iframe)"; content:"|03|xj5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xm9.ru (malware)"; content:"|03|xm9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnescat.info (malware)"; content:"|07|xnescat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq0.ru (malware)"; content:"|03|xq0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq1.ru (malware)"; content:"|03|xq1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq8.ru (malware)"; content:"|03|xq8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xq9.ru (malware)"; content:"|03|xq9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt6.in (iframe)"; content:"|03|xt6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yiiw.in (malware)"; content:"|04|yiiw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youvideoss.com (fake_codec)"; content:"|0a|youvideoss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youvideozz.com (fake_codec)"; content:"|0a|youvideozz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yt118.com (malware)"; content:"|05|yt118|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuesha.com (malware)"; content:"|06|yuesha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 09xss.cn (malware)"; content:"|05|09xss|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39u.ru (malware)"; content:"|03|39u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39w.ru (malware)"; content:"|03|39w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39y.ru (malware)"; content:"|03|39y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3a1.ru (malware)"; content:"|03|3a1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3a2.ru (malware)"; content:"|03|3a2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b4.ru (malware)"; content:"|03|3b4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b5.ru (malware)"; content:"|03|3b5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b6.ru (malware)"; content:"|03|3b6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b7.ru (malware)"; content:"|03|3b7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b8.ru (malware)"; content:"|03|3b8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3b9.ru (malware)"; content:"|03|3b9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3bp.ru (malware)"; content:"|03|3bp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3w90.co.cc (zeus)"; content:"|04|3w90|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5w90.co.cc (zeus)"; content:"|04|5w90|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7lovr.cn (malware)"; content:"|05|7lovr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5l.ru (malware)"; content:"|03|a5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a6n.ru (malware)"; content:"|03|a6n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a6o.ru (malware)"; content:"|03|a6o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a8d.ru (malware)"; content:"|03|a8d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a8e.ru (malware)"; content:"|03|a8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a9j.ru (malware)"; content:"|03|a9j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a9k.ru (malware)"; content:"|03|a9k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarescanner-v4.com (rogue)"; content:"|15|antimalwarescanner-v4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-doktor-2009.com (malware)"; content:"|15|antivirus-doktor-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusdoktor-2009.com (malware)"; content:"|14|antivirusdoktor-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusdoktor.com (malware)"; content:"|0f|antivirusdoktor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusdoktor2009.com (malware)"; content:"|13|antivirusdoktor2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispywarescanv4.com (malware)"; content:"|15|bestantispywarescanv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8b.ru (malware)"; content:"|03|c8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8k.ru (malware)"; content:"|03|c8k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8t.ru (malware)"; content:"|03|c8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c9e.at (malware)"; content:"|03|c9e|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cc9jhdsa.cn (malware)"; content:"|08|cc9jhdsa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5l.at (malware)"; content:"|03|f5l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5l.ru (malware)"; content:"|03|f5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5x.ru (malware)"; content:"|03|f5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6p.at (malware)"; content:"|03|f6p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6p.ru (malware)"; content:"|03|f6p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellh.net (malware)"; content:"|05|hellh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-doktor-2009.com (malware)"; content:"|13|malware-doktor-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwaredoktor.com (malware)"; content:"|0d|malwaredoktor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieshouse.info (malware)"; content:"|0b|movieshouse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystemguard.com (malware)"; content:"|0d|mysystemguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystemshield.com (malware)"; content:"|0e|mysystemshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup professionalmalwarescanv7.com (rogue)"; content:"|19|professionalmalwarescanv7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1k.ru (iframe)"; content:"|03|q1k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1m.ru (iframe)"; content:"|03|q1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1n.in (iframe)"; content:"|03|q1n|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1u.ru (iframe)"; content:"|03|q1u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1v.ru (malware)"; content:"|03|q1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1x.in (iframe)"; content:"|03|q1x|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1x.ru (malware)"; content:"|03|q1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3b.ru (malware)"; content:"|03|q3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3e.ru (malware)"; content:"|03|q3e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3n.ru (malware)"; content:"|03|q3n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3o.ru (malware)"; content:"|03|q3o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q40.ru (iframe)"; content:"|03|q40|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q47.ru (malware)"; content:"|03|q47|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5a.ru (iframe)"; content:"|03|q5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5c.ru (iframe)"; content:"|03|q5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5e.ru (malware)"; content:"|03|q5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5l.ru (iframe)"; content:"|03|q5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5m.ru (iframe)"; content:"|03|q5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5n.ru (malware)"; content:"|03|q5n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5u.ru (iframe)"; content:"|03|q5u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5v.ru (iframe)"; content:"|03|q5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5y.in (iframe)"; content:"|03|q5y|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5y.ru (malware)"; content:"|03|q5y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registry-doktor-2009.com (malware)"; content:"|14|registry-doktor-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registry-doktor.com (malware)"; content:"|0f|registry-doktor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrydoktor.com (malware)"; content:"|0e|registrydoktor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrydoktor2009.com (malware)"; content:"|12|registrydoktor2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrydoktor2009.info (malware)"; content:"|12|registrydoktor2009|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrydoktor2009.org (malware)"; content:"|12|registrydoktor2009|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removeallmalwarenow.com (rogue)"; content:"|13|removeallmalwarenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reparation-windows-xp.com (malware)"; content:"|15|reparation-windows-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-your-computer-now.com (malware)"; content:"|16|scan-your-computer-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-your-pc-now.com (malware)"; content:"|10|scan-your-pc-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonlineworld.com (malware)"; content:"|0f|scanonlineworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansponline.cn (malware)"; content:"|0c|scansponline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanspywaresonline.net (malware)"; content:"|12|scanspywaresonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0b.ru (malware)"; content:"|03|u0b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0r.in (iframe)"; content:"|03|u0r|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0s.in (malware)"; content:"|03|u0s|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0s.ru (iframe)"; content:"|03|u0s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0t.ru (iframe)"; content:"|03|u0t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u19.in (iframe)"; content:"|03|u19|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1a.ru (iframe)"; content:"|03|u1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1j.in (iframe)"; content:"|03|u1j|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1l.ru (iframe)"; content:"|03|u1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1m.ru (malware)"; content:"|03|u1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1w.ru (iframe)"; content:"|03|u1w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1x.ru (malware)"; content:"|03|u1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1y.ru (malware)"; content:"|03|u1y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3h.in (iframe)"; content:"|03|u3h|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3h.ru (malware)"; content:"|03|u3h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3w.ru (iframe)"; content:"|03|u3w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5d.ru (iframe)"; content:"|03|u5d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5e.ru (malware)"; content:"|03|u5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5k.ru (malware)"; content:"|03|u5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5l.ru (iframe)"; content:"|03|u5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5t.ru (malware)"; content:"|03|u5t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5w.ru (iframe)"; content:"|03|u5w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6b.ru (malware)"; content:"|03|u6b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6c.ru (iframe)"; content:"|03|u6c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6d.ru (malware)"; content:"|03|u6d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6v.ru (malware)"; content:"|03|u6v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6x.ru (malware)"; content:"|03|u6x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7f.ru (malware)"; content:"|03|u7f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7g.ru (iframe)"; content:"|03|u7g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7o.ru (iframe)"; content:"|03|u7o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7z.ru (iframe)"; content:"|03|u7z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8h.in (malware)"; content:"|03|u8h|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8i.ru (malware)"; content:"|03|u8i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8j.ru (malware)"; content:"|03|u8j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8r.ru (malware)"; content:"|03|u8r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8t.ru (malware)"; content:"|03|u8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8v.ru (malware)"; content:"|03|u8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9a.in (malware)"; content:"|03|u9a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9a.ru (iframe)"; content:"|03|u9a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9c.ru (malware)"; content:"|03|u9c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9i.ru (iframe)"; content:"|03|u9i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiskduiretog.com (malware)"; content:"|0c|uiskduiretog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoguidez.com (fake_codec)"; content:"|0b|videoguidez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videolifezzz.com (fake_codec)"; content:"|0c|videolifezzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vulisandoratosa.com (malware)"; content:"|0f|vulisandoratosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whjiadian.com (malware)"; content:"|09|whjiadian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwconfig.com (malware)"; content:"|09|wwwconfig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwudacha.com (malware)"; content:"|09|wwwudacha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0a.in (iframe)"; content:"|03|x0a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0a.ru (malware)"; content:"|03|x0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0b.ru (malware)"; content:"|03|x0b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0c.ru (malware)"; content:"|03|x0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0q.ru (malware)"; content:"|03|x0q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1g.in (iframe)"; content:"|03|x1g|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1g.ru (malware)"; content:"|03|x1g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1v.ru (malware)"; content:"|03|x1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3a.in (malware)"; content:"|03|x3a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3a.ru (malware)"; content:"|03|x3a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3v.in (iframe)"; content:"|03|x3v|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3v.ru (malware)"; content:"|03|x3v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3y.ru (malware)"; content:"|03|x3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x5o.ru (iframe)"; content:"|03|x5o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6i.ru (iframe)"; content:"|03|x6i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6p.in (iframe)"; content:"|03|x6p|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6r.ru (malware)"; content:"|03|x6r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7b.in (iframe)"; content:"|03|x7b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7c.ru (malware)"; content:"|03|x7c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7k.ru (malware)"; content:"|03|x7k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7l.ru (malware)"; content:"|03|x7l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7o.ru (iframe)"; content:"|03|x7o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8b.in (malware)"; content:"|03|x8b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8b.ru (malware)"; content:"|03|x8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8c.ru (iframe)"; content:"|03|x8c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8e.ru (iframe)"; content:"|03|x8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9d.ru (malware)"; content:"|03|x9d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9e.ru (malware)"; content:"|03|x9e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9f.ru (malware)"; content:"|03|x9f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9g.ru (malware)"; content:"|03|x9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9m.ru (malware)"; content:"|03|x9m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9n.ru (malware)"; content:"|03|x9n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9u.ru (malware)"; content:"|03|x9u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9y.ru (iframe)"; content:"|03|x9y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb4.in (iframe)"; content:"|03|xb4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb8.ru (malware)"; content:"|03|xb8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbl.kz (malware)"; content:"|03|xbl|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc6.in (iframe)"; content:"|03|xc6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcuilofertun.com (malware)"; content:"|0c|xcuilofertun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xd4.ru (malware)"; content:"|03|xd4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xe5.ru (malware)"; content:"|03|xe5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xe9.ru (malware)"; content:"|03|xe9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf0.ru (malware)"; content:"|03|xf0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf7.ru (malware)"; content:"|03|xf7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf8.ru (iframe)"; content:"|03|xf8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xf9.ru (malware)"; content:"|03|xf9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg0.ru (malware)"; content:"|03|xg0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg8.in (iframe)"; content:"|03|xg8|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg8.ru (malware)"; content:"|03|xg8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xg9.ru (malware)"; content:"|03|xg9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt6.ru (malware)"; content:"|03|xt6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xv8.ru (malware)"; content:"|03|xv8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xv9.ru (malware)"; content:"|03|xv9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-updating-service.cn (zeus)"; content:"|16|adobe-updating-service|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akesheronline.com (malware)"; content:"|0d|akesheronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aloxx.com (malware)"; content:"|05|aloxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appz-blog.com (malware)"; content:"|09|appz-blog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avchecknow.info (malware)"; content:"|0a|avchecknow|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awkxw.com (malware)"; content:"|05|awkxw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belljarstudio.com (malware)"; content:"|0d|belljarstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestautoportal.biz (malware)"; content:"|0e|bestautoportal|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestparishotelsnow.com (malware)"; content:"|12|bestparishotelsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booikingaccrosseurope.com (malware)"; content:"|15|booikingaccrosseurope|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botzz.kilu.de (malware)"; content:"|05|botzz|04|kilu|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bugagag.cn (malware)"; content:"|07|bugagag|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulerkanostrase.com (malware)"; content:"|0f|bulerkanostrase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdxudong.com (malware)"; content:"|08|cdxudong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chnrun.com (malware)"; content:"|06|chnrun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckdkj.cn (malware)"; content:"|05|ckdkj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickxz.com (zeus)"; content:"|07|clickxz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commada.cn (malware)"; content:"|07|commada|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup count.count.xj.cn (malware)"; content:"|05|count|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cressy.info (malware)"; content:"|06|cressy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup css-csript.cn (malware)"; content:"|0a|css-csript|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d.aloxx.com (malware)"; content:"|01|d|05|aloxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daodan8.com (malware)"; content:"|07|daodan8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delayyouranswer.cn (malware)"; content:"|0f|delayyouranswer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dia1.cn (malware)"; content:"|04|dia1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.eurccc.cn (malware)"; content:"|04|down|06|eurccc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekespangs.se (malware)"; content:"|09|ekespangs|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elods.cn (malware)"; content:"|05|elods|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extreme-groupinc.cn (malware)"; content:"|10|extreme-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7g.at (malware)"; content:"|03|f7g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fakyha.com (malware)"; content:"|06|fakyha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foqij.cn (malware)"; content:"|05|foqij|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g00glee.cn (zeus)"; content:"|07|g00glee|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g365.net (malware)"; content:"|04|g365|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game158.info (trojan)"; content:"|07|game158|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game163.info (trojan)"; content:"|07|game163|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-files-here.info (malware)"; content:"|0e|get-files-here|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-free-scan.info (malware)"; content:"|0d|get-free-scan|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-updates.info (malware)"; content:"|0b|get-updates|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gheeny.cn (malware)"; content:"|06|gheeny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good712.com (zeus)"; content:"|07|good712|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup great-pcprotect.com (rogue)"; content:"|0f|great-pcprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatnewlifeuk.net (trojan)"; content:"|0e|greatnewlifeuk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grodno-online.com (zeus)"; content:"|0d|grodno-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2609172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gudxyv.cn (malware)"; content:"|06|gudxyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gymarqe.cn (malware)"; content:"|07|gymarqe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqpcscanner.com (malware)"; content:"|0b|hqpcscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hthja.info (trojan)"; content:"|05|hthja|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hustlerscanner.com (rogue)"; content:"|0e|hustlerscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igafep.cn (malware)"; content:"|06|igafep|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igayzde.cn (malware)"; content:"|07|igayzde|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igeuvat.cn (malware)"; content:"|07|igeuvat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihaegup.cn (malware)"; content:"|07|ihaegup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inclin.info (malware)"; content:"|06|inclin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j7c7c.cn (malware)"; content:"|05|j7c7c|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jremubacom.com (rogue)"; content:"|0a|jremubacom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ka4estvo.com (zeus)"; content:"|08|ka4estvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcs.cn (malware)"; content:"|03|kcs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kimchistory.freevar.com (malware)"; content:"|0b|kimchistory|07|freevar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laoding.net (malware)"; content:"|07|laoding|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lezgogo.info (malware)"; content:"|07|lezgogo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lisiobubucamacho.com (malware)"; content:"|10|lisiobubucamacho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcusmed.com (malware)"; content:"|09|marcusmed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylbbs.info (malware)"; content:"|06|mylbbs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neimeetsmysla.cn (malware)"; content:"|0d|neimeetsmysla|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvujinaw.cn (malware)"; content:"|08|nvujinaw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-tooth-fairy.com (malware)"; content:"|12|online-tooth-fairy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinequickscan.com (malware)"; content:"|0f|onlinequickscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orkul.org (zeus)"; content:"|05|orkul|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p1.dy37.com (malware)"; content:"|02|p1|04|dy37|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pczx.net (malware)"; content:"|04|pczx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pilofly.cn (zeus)"; content:"|07|pilofly|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piupiu-110809.com (koobface)"; content:"|0d|piupiu-110809|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poundsofinterests.com (malware)"; content:"|11|poundsofinterests|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup professionalcomputerscanv2.com (malware)"; content:"|1a|professionalcomputerscanv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup professionalspywarescanv8.com (malware)"; content:"|19|professionalspywarescanv8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc.cn (malware)"; content:"|0d|protectyourpc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radio-compact.com (malware)"; content:"|0d|radio-compact|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repare-windows.com (malware)"; content:"|0e|repare-windows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reparer-internet-explorer.com (malware)"; content:"|19|reparer-internet-explorer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reparer-windows-vista.com (malware)"; content:"|15|reparer-windows-vista|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savesoldier.com (malware)"; content:"|0b|savesoldier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servupdate.cn (malware)"; content:"|0a|servupdate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sf-plus.info (malware)"; content:"|07|sf-plus|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simonsoderberg.se (malware)"; content:"|0e|simonsoderberg|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sponlinescan.cn (malware)"; content:"|0c|sponlinescan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t0n.wrzdown.com (zeus)"; content:"|03|t0n|07|wrzdown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tangopu.com (malware)"; content:"|07|tangopu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tastemasters.ca (malware)"; content:"|0c|tastemasters|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telleraw.com (zeus)"; content:"|08|telleraw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tmjy.cn (malware)"; content:"|04|tmjy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackingload.com (malware)"; content:"|0c|trackingload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojaner-doktor-2009.com (malware)"; content:"|14|trojaner-doktor-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojaner-doktor.com (malware)"; content:"|0f|trojaner-doktor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsgd.w6.dh52.com (malware)"; content:"|04|tsgd|02|w6|04|dh52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unowed.info (malware)"; content:"|06|unowed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upr200908013.com (koobface)"; content:"|0c|upr200908013|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veikalerd.com (malware)"; content:"|09|veikalerd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walmartsoftware.com (malware)"; content:"|0f|walmartsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weiwei520.vip.sina.com (malware)"; content:"|09|weiwei520|03|vip|04|sina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsxp-reparieren.com (malware)"; content:"|14|windowsxp-reparieren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldbestonlinescanner2.com (rogue)"; content:"|17|worldbestonlinescanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xaker.cn (malware)"; content:"|05|xaker|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xombag.com (malware)"; content:"|06|xombag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xomusti.info (malware)"; content:"|07|xomusti|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxzonexx.com (malware)"; content:"|08|xxzonexx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yessvaz.cn (malware)"; content:"|07|yessvaz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yqqz.net (malware)"; content:"|04|yqqz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yzhuaxiang.cn (malware)"; content:"|0a|yzhuaxiang|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenitvsspartak.cn (malware)"; content:"|0e|zenitvsspartak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitslog.info (exploit)"; content:"|07|hitslog|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milk0soft.com (malware)"; content:"|09|milk0soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newporntv.com (fake_codec)"; content:"|09|newporntv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-n-d-the.com (malware)"; content:"|09|a-n-d-the|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwaredollars.com (coolwebsearch)"; content:"|0d|adwaredollars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwarepro.com (rogue)"; content:"|09|adwarepro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaremaster.com (malvertisement)"; content:"|11|antispywaremaster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirprotect.com (rogue_antivirus)"; content:"|0e|antivirprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arclane.com (malware)"; content:"|07|arclane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codecplay.com (fake_codec)"; content:"|09|codecplay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deewoo.net (malware)"; content:"|06|deewoo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzuc.net (malware)"; content:"|04|dzuc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup errorsweeper.com (rogue)"; content:"|0c|errorsweeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flwcoupler.com (zlob)"; content:"|0a|flwcoupler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flwsolution.com (zlob)"; content:"|0b|flwsolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flycodecs.com (malware)"; content:"|09|flycodecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-spybot.com (rogue)"; content:"|0b|free-spybot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamecodec.com (fake_codec)"; content:"|09|gamecodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getadultaccess.com (rogue)"; content:"|0e|getadultaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-pornotube-2008.com (iframe)"; content:"|12|hot-pornotube-2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-pornotube08.com (iframe)"; content:"|0f|hot-pornotube08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-sextubecodec.com (fake_codec)"; content:"|10|hot-sextubecodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-tubecodec20.com (iframe)"; content:"|0f|hot-tubecodec20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornotube08.com (iframe)"; content:"|0e|hotpornotube08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqcodec.net (malware_rbn)"; content:"|07|hqcodec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loads.cc (malware)"; content:"|05|loads|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmcodecs.com (fake_codec)"; content:"|08|mmcodecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playmp3z.biz (malware)"; content:"|08|playmp3z|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regfixit.com (rogue)"; content:"|08|regfixit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrycleanerxp.com (rogue)"; content:"|11|registrycleanerxp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removal-tool.com (rogue)"; content:"|0c|removal-tool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securecleaner.com (coolwebsearch)"; content:"|0d|securecleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureinstruct.com (zlob)"; content:"|0e|secureinstruct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-destroyer.com (coolwebsearch)"; content:"|0d|spy-destroyer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-shredder.com (coolwebsearch)"; content:"|0c|spy-shredder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spydefenders.com (coolwebsearch)"; content:"|0c|spydefenders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareisolator.com (malware)"; content:"|0f|spywareisolator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-defender.com (malware)"; content:"|0f|system-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-spyware-review.com (rogue)"; content:"|12|the-spyware-review|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2601213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theinstalls.com (malware)"; content:"|0b|theinstalls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theinstalls.net (malware)"; content:"|0b|theinstalls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winquickupdates.com (malware)"; content:"|0f|winquickupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xanjan.cn (exploit)"; content:"|06|xanjan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpantivirus.com (iframe)"; content:"|0b|xpantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourprivacyguard.com (coolwebsearch)"; content:"|10|yourprivacyguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activeprotect.cn (malware)"; content:"|0d|activeprotect|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adserv.cn (badware)"; content:"|06|adserv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetyalertings.com (zlob)"; content:"|0f|safetyalertings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swfinstrument.com (zlob)"; content:"|0d|swfinstrument|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swfutility.com (zlob)"; content:"|0a|swfutility|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsxp-privacy.net (malware)"; content:"|11|windowsxp-privacy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winspywareprotect.com (rogue)"; content:"|11|winspywareprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xp-protect-2008.com (rogue)"; content:"|0f|xp-protect-2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpantivirussite.com (badware)"; content:"|0f|xpantivirussite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpenprotect.com (rogue)"; content:"|0b|xpenprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xponlinescanner.com (rogue)"; content:"|0f|xponlinescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xprmn4u.info (iframe)"; content:"|07|xprmn4u|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 18xn.com (sql_injection)"; content:"|04|18xn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1a-7294.antagus.de (malware)"; content:"|07|1a-7294|07|antagus|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1kfie.cn (sql_injection)"; content:"|05|1kfie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 28zxc.ws (malware)"; content:"|05|28zxc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 345s.com (malware)"; content:"|04|345s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5fgh.ws (malware)"; content:"|04|5fgh|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 88mw.com (malware)"; content:"|04|88mw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 88wdvd.cn (malware)"; content:"|06|88wdvd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 99boxx.com (malware)"; content:"|06|99boxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3h.at (malware)"; content:"|03|a3h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3l.at (malware)"; content:"|03|a3l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3q.at (malware)"; content:"|03|a3q|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5f.at (malware)"; content:"|03|a5f|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5h.at (malware)"; content:"|03|a5h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5j.at (malware)"; content:"|03|a5j|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5m.at (malware)"; content:"|03|a5m|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ablegang.com (malware)"; content:"|08|ablegang|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedpcscanner2.com (malware)"; content:"|12|advancedpcscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedpcscanner3.com (malware)"; content:"|12|advancedpcscanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedpcscanner6.com (malware)"; content:"|12|advancedpcscanner6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedpcscanner9.com (malware)"; content:"|12|advancedpcscanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedvirscanner3.com (malware)"; content:"|13|advancedvirscanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-deluxe.com (malware)"; content:"|10|antivirus-deluxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-xp.awardspace.us (malware)"; content:"|0c|antivirus-xp|0a|awardspace|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusplus1.com (malware)"; content:"|0e|antivirusplus1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusquickscan3.com (malware)"; content:"|13|antivirusquickscan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusquickscan5.com (malware)"; content:"|13|antivirusquickscan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apalet.info (malware)"; content:"|06|apalet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armor-groupco.cc (malware)"; content:"|0d|armor-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armor-groupco.cn (malware)"; content:"|0d|armor-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scan-2009-up.com (malware)"; content:"|0f|av-scan-2009-up|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scan-2009.com (malware)"; content:"|0c|av-scan-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanner-2009.com (malware)"; content:"|0f|av-scanner-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avir-guardian.com (rogue)"; content:"|0d|avir-guardian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awareremover.com (malware)"; content:"|0c|awareremover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5c.at (malware)"; content:"|03|b5c|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5r.at (malware)"; content:"|03|b5r|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6l.at (malware)"; content:"|03|b6l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6t.at (malware)"; content:"|03|b6t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7g.at (malware)"; content:"|03|b7g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7p.at (malware)"; content:"|03|b7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachhousename.cn (malware)"; content:"|0e|beachhousename|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besecuresallpcs.com (malware)"; content:"|0f|besecuresallpcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antivirus3.com (rogue)"; content:"|0f|best-antivirus3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antivirus8.com (malware)"; content:"|0f|best-antivirus8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-virus-scanner4.com (malware)"; content:"|13|best-virus-scanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-virus-scanner6.com (rogue)"; content:"|13|best-virus-scanner6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantivirusscanv8.com (malware)"; content:"|13|bestantivirusscanv8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanantispywarev3.com (rogue)"; content:"|15|bestscanantispywarev3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopleads.cn (malware)"; content:"|0b|bigtopleads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtoprocks.cn (malware)"; content:"|0b|bigtoprocks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boksx.com (malware)"; content:"|05|boksx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxhidden.com (malware)"; content:"|09|boxhidden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bqtl.in (malware)"; content:"|04|bqtl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandschutztechnik-hartmann.de (malware)"; content:"|1b|brandschutztechnik-hartmann|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c6h.at (malware)"; content:"|03|c6h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7h.at (malware)"; content:"|03|c7h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7r.at (malware)"; content:"|03|c7r|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c8t.at (malware)"; content:"|03|c8t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c9m.at (malware)"; content:"|03|c9m|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c9m.ru (malware)"; content:"|03|c9m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c9u.at (malware)"; content:"|03|c9u|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cahsbadaboom.awardspace.us (malware)"; content:"|0c|cahsbadaboom|0a|awardspace|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup captum.info (rogue)"; content:"|06|captum|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkvirus-zone.net (malware)"; content:"|0f|checkvirus-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-all-spyware07.com (rogue)"; content:"|13|clean-all-spyware07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cncn88cn.cn (malware)"; content:"|08|cncn88cn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolnssecurity.com (malware)"; content:"|0e|coolnssecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosco-groupmain.cn (malware)"; content:"|0f|cosco-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosco-groupmain.com (malware)"; content:"|0f|cosco-groupmain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dateing.de (malware)"; content:"|07|dateing|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datescout.de (malware)"; content:"|09|datescout|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dd88567.cn (malware)"; content:"|07|dd88567|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dma.ma (malware)"; content:"|03|dma|02|ma"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downbt.com (malware)"; content:"|06|downbt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download4safe.com (malware)"; content:"|0d|download4safe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwsx.com (sql_injection)"; content:"|04|dwsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynamicfilmmedia.cn (malware)"; content:"|10|dynamicfilmmedia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earchsafetyprotection.net (malware)"; content:"|15|earchsafetyprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebookexpress.de (malware)"; content:"|0c|ebookexpress|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enlarg.info (rogue)"; content:"|06|enlarg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enter.popporn.in (malware)"; content:"|05|enter|07|popporn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entreamis.ma (malware)"; content:"|09|entreamis|02|ma"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entryservice.de (malware)"; content:"|0c|entryservice|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup envied.info (rogue)"; content:"|06|envied|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erpeer.info (malware)"; content:"|06|erpeer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertubedewse.com (harmful)"; content:"|0b|ertubedewse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup espied.info (rogue)"; content:"|06|espied|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6y.at (malware)"; content:"|03|f6y|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7p.at (malware)"; content:"|03|f7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7y.at (malware)"; content:"|03|f7y|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f8a.at (malware)"; content:"|03|f8a|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup figgle.info (malware)"; content:"|06|figgle|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup froday.info (malware)"; content:"|06|froday|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gehae.info (sql_injection)"; content:"|05|gehae|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scansystem.com (malware)"; content:"|0d|go-scansystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scansystem.net (malware)"; content:"|0d|go-scansystem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-searchprotection.com (malware)"; content:"|13|go-searchprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goeachscan.com (malware)"; content:"|0a|goeachscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotomyprotectedzone.com (malware)"; content:"|13|gotomyprotectedzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatestsecscans.com (malware)"; content:"|10|greatestsecscans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenbillsystem.com (malware)"; content:"|0f|greenbillsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grumio.info (malware)"; content:"|06|grumio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gssmedia.cn (downloader)"; content:"|08|gssmedia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haerh.info (sql_injection)"; content:"|05|haerh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardnut.cn (harmful)"; content:"|07|hardnut|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhbg.in (malware)"; content:"|04|hhbg|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homepersonalantivirus.com (malware)"; content:"|15|homepersonalantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqvirusscanner2.com (malware)"; content:"|0f|hqvirusscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huchinu.com (malware)"; content:"|07|huchinu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyg12zk.eu (phishing)"; content:"|07|hyg12zk|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyg12zq.eu (phishing)"; content:"|07|hyg12zq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11heb.eu (phishing)"; content:"|08|hyu11heb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11hep.eu (phishing)"; content:"|08|hyu11hep|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11hew.eu (phishing)"; content:"|08|hyu11hew|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iframecash.net (malware)"; content:"|0a|iframecash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iis.mo.cn (malware)"; content:"|03|iis|02|mo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilixyeq.cn (malware)"; content:"|07|ilixyeq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilodux.cn (malware)"; content:"|06|ilodux|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iloefe.cn (malware)"; content:"|06|iloefe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iluefot.cn (malware)"; content:"|07|iluefot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imjustbored.com (harmful)"; content:"|0b|imjustbored|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imoviemax.ru (downloader)"; content:"|09|imoviemax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in-t-h-e.cn (malware)"; content:"|08|in-t-h-e|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inb4ch.com (rogue)"; content:"|06|inb4ch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intsecureprof.com (rogue)"; content:"|0d|intsecureprof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invalda-groupmain.cn (malware)"; content:"|11|invalda-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipqk.in (malware)"; content:"|04|ipqk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jackvn.net (malware)"; content:"|06|jackvn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaybi.ma (malware)"; content:"|05|jaybi|02|ma"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jayfor.com (malware)"; content:"|06|jayfor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kbgg.in (malware)"; content:"|04|kbgg|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kgapofef.cn (malware)"; content:"|08|kgapofef|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kissfromde.cn (harmful)"; content:"|0a|kissfromde|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkxv.in (malware)"; content:"|04|kkxv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lapsek.info (malware)"; content:"|06|lapsek|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup larkmedia.ru (trojan)"; content:"|09|larkmedia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livetimesecurityscan.com (rogue)"; content:"|14|livetimesecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livetimevirusscaner.com (rogue)"; content:"|13|livetimevirusscaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowexe.com (malware)"; content:"|06|lowexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowexeonline.com (malware)"; content:"|0c|lowexeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martpictureexistence.cn (malware)"; content:"|14|martpictureexistence|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashroomtheory.cn (malware)"; content:"|0e|mashroomtheory|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcsmc.org (malware)"; content:"|05|mcsmc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meldorgroup.cn (malware)"; content:"|0b|meldorgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micronetsys.org (malware)"; content:"|0b|micronetsys|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnprfix.cn (malware)"; content:"|07|mnprfix|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movies-hidden-places.com (malware)"; content:"|14|movies-hidden-places|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylovsecurity.com (malware)"; content:"|0d|mylovsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotected-zone.com (malware)"; content:"|10|myprotected-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecurityshield.net (malware)"; content:"|10|mysecurityshield|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpcguard.net (malware)"; content:"|0a|newpcguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nqrl.in (malware)"; content:"|04|nqrl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns37428.ovh.net (malware)"; content:"|07|ns37428|03|ovh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyusa2a.eu (phishing)"; content:"|07|nyusa2a|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyusa2b.eu (phishing)"; content:"|07|nyusa2b|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyusa2s.eu (phishing)"; content:"|07|nyusa2s|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup officesecuritysupply.com (rogue)"; content:"|14|officesecuritysupply|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oufc.in (malware)"; content:"|04|oufc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pagerank-backlinks.de (malware)"; content:"|12|pagerank-backlinks|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pagerank-submit.de (malware)"; content:"|0f|pagerank-submit|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pickknob.info (rogue)"; content:"|08|pickknob|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pictswizard.com (harmful)"; content:"|0b|pictswizard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleach.info (rogue)"; content:"|06|pleach|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polear.info (malware)"; content:"|06|polear|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porno-inter.ru (malware)"; content:"|0b|porno-inter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pro-voting.com (malware)"; content:"|0a|pro-voting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proofdefender.com (rogue)"; content:"|0d|proofdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmycomputernow.com (rogue)"; content:"|14|protectmycomputernow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup publicpub.net (malware)"; content:"|09|publicpub|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0j.ru (malware)"; content:"|03|q0j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0w.ru (malware)"; content:"|03|q0w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1f.ru (malware)"; content:"|03|q1f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1l.ru (malware)"; content:"|03|q1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1n.ru (malware)"; content:"|03|q1n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3c.ru (malware)"; content:"|03|q3c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5k.ru (malware)"; content:"|03|q5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qingchun-meinv.cn (malware)"; content:"|0e|qingchun-meinv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qoeirq.com (downloader)"; content:"|06|qoeirq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-virus-scanner01.com (harmful)"; content:"|15|quick-virus-scanner01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickhealcleaner.com (malware)"; content:"|10|quickhealcleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ranking-charts.com (malware)"; content:"|0e|ranking-charts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s1p5.info (malware)"; content:"|04|s1p5|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetysystem-shield.net (malware)"; content:"|13|safetysystem-shield|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sallat.info (malware)"; content:"|06|sallat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-secure.net (malware)"; content:"|0b|scan-secure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4youpconline.com (malware)"; content:"|10|scan4youpconline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonline-protect.com (malware)"; content:"|12|scanonline-protect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonline-protect.net (malware)"; content:"|12|scanonline-protect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansystem-online.com (malware)"; content:"|11|scansystem-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansystemonline.com (malware)"; content:"|10|scansystemonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scantoolsite.com (malware)"; content:"|0c|scantoolsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanvirus-online.net (malware)"; content:"|10|scanvirus-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searce.info (malware)"; content:"|06|searce|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-systemshield.com (malware)"; content:"|13|search-systemshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-systemshield.net (malware)"; content:"|13|secure-systemshield|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexyy.ru (trojan)"; content:"|05|sexyy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seyconel.com.br (malware)"; content:"|08|seyconel|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sicyon.info (rogue)"; content:"|06|sicyon|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slatch.info (malware)"; content:"|06|slatch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soac.in (malware)"; content:"|04|soac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spelem.info (malware)"; content:"|06|spelem|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stonek.info (rogue)"; content:"|06|stonek|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-guard.net (malware)"; content:"|0c|system-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-guard2009.com (rogue)"; content:"|10|system-guard2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tenshy.info (malware)"; content:"|06|tenshy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegreatav.com (malware)"; content:"|0a|thegreatav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tour6.info (malware)"; content:"|05|tour6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup towton.info (malware)"; content:"|06|towton|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffok.cn (harmful)"; content:"|07|traffok|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsfxzg.info (malware)"; content:"|06|tsfxzg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0r.ru (malware)"; content:"|03|u0r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1j.ru (malware)"; content:"|03|u1j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3j.ru (malware)"; content:"|03|u3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3m.ru (malware)"; content:"|03|u3m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3v.ru (malware)"; content:"|03|u3v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3y.ru (malware)"; content:"|03|u3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5m.ru (malware)"; content:"|03|u5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5v.ru (malware)"; content:"|03|u5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6k.ru (malware)"; content:"|03|u6k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6n.ru (malware)"; content:"|03|u6n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7e.ru (malware)"; content:"|03|u7e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7n.ru (malware)"; content:"|03|u7n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7x.ru (malware)"; content:"|03|u7x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8b.ru (malware)"; content:"|03|u8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u8h.ru (malware)"; content:"|03|u8h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9b.ru (malware)"; content:"|03|u9b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9k.ru (malware)"; content:"|03|u9k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultrapc-scan.com (malware)"; content:"|0c|ultrapc-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unroot.info (malware)"; content:"|06|unroot|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uppd.in (malware)"; content:"|04|uppd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-windowsupdate.com (malware)"; content:"|10|us-windowsupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vagrom.info (malware)"; content:"|06|vagrom|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vanni-van.cn (downloader)"; content:"|09|vanni-van|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vector-groupfine.cn (malware)"; content:"|10|vector-groupfine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vector-groupfly.cc (malware)"; content:"|0f|vector-groupfly|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusermoverpro.com (rogue)"; content:"|0f|virusermoverpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusfilter-zone.net (malware)"; content:"|10|virusfilter-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viruskill2009.com (rogue)"; content:"|0d|viruskill2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vista-store.de (malware)"; content:"|0b|vista-store|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voided.info (malware)"; content:"|06|voided|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrenutredo.com (malware)"; content:"|0a|vrenutredo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-masteru.do.am (harmful)"; content:"|0b|web-masteru|02|do|02|am"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsguardpro.com (malware)"; content:"|0f|windowsguardpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsultimate-guard.com (malware)"; content:"|15|windowsultimate-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotection-suite.net (malware)"; content:"|13|winprotection-suite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wins-guard.com (rogue)"; content:"|0a|wins-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0o.ru (malware)"; content:"|03|x0o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xrbw.in (malware)"; content:"|04|xrbw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynaa.in (malware)"; content:"|04|ynaa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z360.net (sql_injection)"; content:"|04|z360|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 97kanmm.cn (malware)"; content:"|07|97kanmm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-virus-2010.com (rogue)"; content:"|0c|a-virus-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-virus2010.com (rogue)"; content:"|0b|a-virus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aha-shame-shame.com (phishing)"; content:"|0f|aha-shame-shame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-solution.org (rogue)"; content:"|13|anti-virus-solution|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-xp-pro2009.com (malware)"; content:"|15|anti-virus-xp-pro2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-scanner2.com (malware)"; content:"|14|antispyware-scanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-fast-scan01.com (rogue)"; content:"|15|antivirus-fast-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-fast-scan02.com (rogue)"; content:"|15|antivirus-fast-scan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-fast-scan04.com (rogue)"; content:"|15|antivirus-fast-scan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-fast-scan05.com (rogue)"; content:"|15|antivirus-fast-scan05|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-p-2010.com (rogue)"; content:"|10|antivirus-p-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-p2010.com (rogue)"; content:"|0f|antivirus-p2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pro-2010.com (rogue)"; content:"|12|antivirus-pro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pro2010.com (rogue)"; content:"|11|antivirus-pro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-promo-scan.com (malware)"; content:"|14|antivirus-promo-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scanner6.com (malware)"; content:"|12|antivirus-scanner6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusfilter-zone.com (scareware)"; content:"|14|antivirusfilter-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusonlinescan6.com (rogue)"; content:"|14|antivirusonlinescan6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusp-2010.com (rogue)"; content:"|0f|antivirusp-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusp2010.com (rogue)"; content:"|0e|antivirusp2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro-2010.com (rogue)"; content:"|11|antiviruspro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro2010.com (rogue)"; content:"|10|antiviruspro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusquickscan2.com (rogue)"; content:"|13|antivirusquickscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apelsin4ik.co.cc (malware)"; content:"|0a|apelsin4ik|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archway-groupinc.com (money_mule)"; content:"|10|archway-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arda.or.th (malware)"; content:"|04|arda|02|or|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armartshop.com (suspicious)"; content:"|0a|armartshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arosakilomen.com (malware)"; content:"|0c|arosakilomen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artvariety.co.za (malware)"; content:"|0a|artvariety|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-pro2010.com (rogue)"; content:"|0a|av-pro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avchecknow.com (malware)"; content:"|0a|avchecknow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avirus-2010.com (rogue)"; content:"|0b|avirus-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avirus2010.com (rogue)"; content:"|0a|avirus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avpro2010.com (rogue)"; content:"|09|avpro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bazarish.net (zeus)"; content:"|08|bazarish|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcobanut.cn (malspam)"; content:"|08|bcobanut|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcugusot.cn (malspam)"; content:"|08|bcugusot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdekowip.cn (malspam)"; content:"|08|bdekowip|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdonilix.cn (malspam)"; content:"|08|bdonilix|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beeves.info (suspicious)"; content:"|06|beeves|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bervuilendosate.com (malware)"; content:"|0f|bervuilendosate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-erotic.mcdir.ru (malware)"; content:"|0b|best-erotic|05|mcdir|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-live-lottery.cn (malware)"; content:"|11|best-live-lottery|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestexe.com (malicious)"; content:"|07|bestexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestexeonline.com (malicious)"; content:"|0d|bestexeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanpc.net (malware)"; content:"|0a|bestscanpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bethanyhousetwells.co.uk (malware)"; content:"|12|bethanyhousetwells|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgsew.com (iframe)"; content:"|05|bgsew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bideqta.cn (rogue)"; content:"|07|bideqta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluepadma.com (malware)"; content:"|09|bluepadma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnbsuubtvvsyy4ndvg.com (malware)"; content:"|12|bnbsuubtvvsyy4ndvg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boomexe.com (malware)"; content:"|07|boomexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boomexesite.com (malicious)"; content:"|0b|boomexesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxenstopp.biz (malware)"; content:"|0a|boxenstopp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bravemousepride.com (malware)"; content:"|0f|bravemousepride|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buhervadoska.com (malware)"; content:"|0c|buhervadoska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bumergonagortaut.com (malware)"; content:"|10|bumergonagortaut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bundesregeirung.de (malware)"; content:"|0f|bundesregeirung|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdmhsxdght.net (rogue)"; content:"|0a|cdmhsxdght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cityfit.ru (malware)"; content:"|07|cityfit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clxwe.com (malware)"; content:"|05|clxwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosovowar.cn (malware)"; content:"|09|cosovowar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crisis1s.com (malware)"; content:"|08|crisis1s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csjh.tpc.edu.tw (malware)"; content:"|04|csjh|03|tpc|03|edu|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d10gc.cn (malware)"; content:"|05|d10gc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup db9qq.cn (malware)"; content:"|05|db9qq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedkeopght.net (rogue)"; content:"|0a|dedkeopght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denpcysght.net (rogue)"; content:"|0a|denpcysght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derebas.co.cc (zeus)"; content:"|07|derebas|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dile1.info (malware)"; content:"|05|dile1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dimka2009.real-host.org (zeus)"; content:"|09|dimka2009|09|real-host|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkitistnoif.info (malware)"; content:"|0b|dkitistnoif|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dns-systems123.com (malware)"; content:"|0e|dns-systems123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsless.gh0sthosting.com (malware)"; content:"|07|dnsless|0c|gh0sthosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleclick-rss.com (harmful)"; content:"|0f|doubleclick-rss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drjwv.com (malware)"; content:"|05|drjwv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup droope.info (scareware)"; content:"|06|droope|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ds.xdns.eu (zeus)"; content:"|02|ds|04|xdns|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ds3gj.cn (malware)"; content:"|05|ds3gj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eelcd5.info (malware)"; content:"|06|eelcd5|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elitedigiscrappers.com (malware)"; content:"|12|elitedigiscrappers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eraean.com (malware)"; content:"|06|eraean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurccc.cn (suspicious)"; content:"|06|eurccc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewaxertulio.com (malware)"; content:"|0b|ewaxertulio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exe-por01.com (rogue)"; content:"|09|exe-por01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expo.ubsc.or.kr (malware)"; content:"|04|expo|04|ubsc|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extremeanalonline.com (malware)"; content:"|11|extremeanalonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6e.ru (malicious)"; content:"|03|f6e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f6y.ru (malicious)"; content:"|03|f6y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7p.ru (malicious)"; content:"|03|f7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f7y.ru (malicious)"; content:"|03|f7y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f8a.ru (malicious)"; content:"|03|f8a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faites.info (scareware)"; content:"|06|faites|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fear-angels.bissnes.org (malware)"; content:"|0b|fear-angels|07|bissnes|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fernudarogal.com (malware)"; content:"|0c|fernudarogal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffxiname.com (malware)"; content:"|08|ffxiname|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgddfgdgdfg.com (malware)"; content:"|0b|fgddfgdgdfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fguyamoz.cn (malware)"; content:"|08|fguyamoz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiminalisimo.net (malware)"; content:"|0c|fiminalisimo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forety.com (malware)"; content:"|06|forety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fpgo.ru (malware)"; content:"|04|fpgo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fragus-v1-1.cn (malware)"; content:"|0b|fragus-v1-1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frantsuz.com (malware)"; content:"|08|frantsuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frantsuzik.com (malware)"; content:"|0a|frantsuzik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-scan-here.com (malware)"; content:"|0e|free-scan-here|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galz177.net (rogue)"; content:"|07|galz177|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gathernet.in (zeus)"; content:"|09|gathernet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gc4fg456hfghfss6sg4.com (zeus)"; content:"|13|gc4fg456hfghfss6sg4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gd1di.cn (malware)"; content:"|05|gd1di|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gd8bb.cn (malware)"; content:"|05|gd8bb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genie-hkfc.com (zeus)"; content:"|0a|genie-hkfc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-safe-files.com (malware)"; content:"|0e|get-safe-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghlyhwpght.net (rogue)"; content:"|0a|ghlyhwpght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidromash.cn (bot)"; content:"|09|gidromash|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmail-pop3.com (malware)"; content:"|0a|gmail-pop3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scanandprotect.com (rogue)"; content:"|11|go-scanandprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gobcounter.org (malware)"; content:"|0a|gobcounter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goffin-escrow.com (money_mule)"; content:"|0d|goffin-escrow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-update-checker.cn (malware)"; content:"|15|google-update-checker|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.hmsite.net (malware)"; content:"|06|google|06|hmsite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlle.in (malware)"; content:"|07|googlle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosalerbas.com (malware)"; content:"|0a|gosalerbas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosstroy.com (malware)"; content:"|08|gosstroy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grabmymotor.com (malware)"; content:"|0b|grabmymotor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup great-connections.com (malware)"; content:"|11|great-connections|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-av-pro.com (rogue)"; content:"|0c|green-av-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-av.com (rogue)"; content:"|08|green-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gt5ev.cn (malware)"; content:"|05|gt5ev|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guianossacidade.com.br (malware)"; content:"|0f|guianossacidade|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hardexeworld.com (malicious)"; content:"|0c|hardexeworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hd6bb.cn (malware)"; content:"|05|hd6bb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hexexe.com (malicious)"; content:"|06|hexexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hexexeterra.com (malicious)"; content:"|0b|hexexeterra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holding-group.cn (money_mule)"; content:"|0d|holding-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imeyerhome.org (money_mule)"; content:"|0a|imeyerhome|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup med-payments.org (money_mule)"; content:"|0c|med-payments|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megahostname.biz (malware)"; content:"|0c|megahostname|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mofmeta.com (harmful)"; content:"|07|mofmeta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneytransferltd.com (fraud)"; content:"|10|moneytransferltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nenastiya.cn (malware)"; content:"|09|nenastiya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-systemshield.com (rogue)"; content:"|10|new-systemshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neweca-payments.com (money_mule)"; content:"|0f|neweca-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottopay.cn (malware)"; content:"|07|ottopay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prepaider.net (harmful)"; content:"|09|prepaider|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-groupco.com (money_mule)"; content:"|0d|prime-groupco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q05.ru (harmful)"; content:"|03|q05|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q07.ru (harmful)"; content:"|03|q07|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1e.ru (harmful)"; content:"|03|q1e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q38.ru (harmful)"; content:"|03|q38|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3t.ru (harmful)"; content:"|03|q3t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q46.ru (harmful)"; content:"|03|q46|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q59.ru (harmful)"; content:"|03|q59|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redeye-groupco.com (money_mule)"; content:"|0e|redeye-groupco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remove-all-adware06.com (rogue)"; content:"|13|remove-all-adware06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rude-xxx-tube.com (malware)"; content:"|0d|rude-xxx-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saturn-groupsvc.com (money_mule)"; content:"|0f|saturn-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shontecltd.com (rogue)"; content:"|0a|shontecltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traiden.org (rogue)"; content:"|07|traiden|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0e.ru (harmful)"; content:"|03|u0e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u19.ru (harmful)"; content:"|03|u19|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u9j.ru (harmful)"; content:"|03|u9j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verticalt.com (rogue)"; content:"|09|verticalt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-protectonline.com (rogue)"; content:"|15|windows-protectonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-systemguard.com (rogue)"; content:"|13|windows-systemguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-systemguard.net (rogue)"; content:"|13|windows-systemguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-virusscan.com (rogue)"; content:"|11|windows-virusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-virusscan.net (rogue)"; content:"|11|windows-virusscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x0v.ru (harmful)"; content:"|03|x0v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1h.ru (harmful)"; content:"|03|x1h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x1i.ru (harmful)"; content:"|03|x1i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3b.ru (harmful)"; content:"|03|x3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6g.ru (harmful)"; content:"|03|x6g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6h.ru (harmful)"; content:"|03|x6h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6p.ru (harmful)"; content:"|03|x6p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x6q.ru (harmful)"; content:"|03|x6q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x7d.ru (harmful)"; content:"|03|x7d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8f.ru (harmful)"; content:"|03|x8f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x8y.ru (harmful)"; content:"|03|x8y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9v.ru (harmful)"; content:"|03|x9v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x9w.ru (harmful)"; content:"|03|x9w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb4.ru (harmful)"; content:"|03|xb4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb5.ru (harmful)"; content:"|03|xb5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc6.ru (harmful)"; content:"|03|xc6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc7.ru (harmful)"; content:"|03|xc7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xe6.ru (harmful)"; content:"|03|xe6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xh9.ru (harmful)"; content:"|03|xh9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xi5.ru (harmful)"; content:"|03|xi5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xj4.ru (harmful)"; content:"|03|xj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xj7.ru (harmful)"; content:"|03|xj7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xk7.ru (harmful)"; content:"|03|xk7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xk9.ru (harmful)"; content:"|03|xk9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xm0.ru (harmful)"; content:"|03|xm0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xr3.ru (harmful)"; content:"|03|xr3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt7.ru (harmful)"; content:"|03|xt7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xt8.ru (harmful)"; content:"|03|xt8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xw0.ru (harmful)"; content:"|03|xw0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 21site.com.cn (malware)"; content:"|06|21site|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 39sys39.cn (exploit)"; content:"|07|39sys39|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7oydomen.cn (malware)"; content:"|08|7oydomen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 81wordfly.de (malware)"; content:"|09|81wordfly|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 84chatterworks.de (malware)"; content:"|0e|84chatterworks|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 87m.co.cc (malware)"; content:"|03|87m|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 90snapset.de (malware)"; content:"|09|90snapset|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2stu.blogdns.com (malware)"; content:"|05|a2stu|07|blogdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaaauto.servebbs.net (malware)"; content:"|07|aaaauto|08|servebbs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaburke.dynalias.org (malware)"; content:"|07|aaburke|08|dynalias|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aamane06.isa-geek.com (malware)"; content:"|08|aamane06|08|isa-geek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aandrioli.servebbs.net (malware)"; content:"|09|aandrioli|08|servebbs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aarab51.go.dyndns.org (malware)"; content:"|07|aarab51|02|go|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aartt.dyn-o-saur.com (malware)"; content:"|05|aartt|0a|dyn-o-saur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abbassi03.homedns.org (malware)"; content:"|09|abbassi03|07|homedns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absbillnow.com (malware)"; content:"|0a|absbillnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admnqtc.cn (malware)"; content:"|07|admnqtc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afedodevascevo.com (malware)"; content:"|0e|afedodevascevo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afgc.asso.fr (malware)"; content:"|04|afgc|04|asso|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agiaten.cn (malware)"; content:"|07|agiaten|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agodaynsvcbert.com (malware)"; content:"|0e|agodaynsvcbert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alertonbgabert.com (malware)"; content:"|0e|alertonbgabert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alex-bron.ru (malware)"; content:"|09|alex-bron|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alioneferkilo.com (malware)"; content:"|0d|alioneferkilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alliance-marketing.cn (malware)"; content:"|12|alliance-marketing|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annunci-motori.it (malware)"; content:"|0e|annunci-motori|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antipirat.cn (malware)"; content:"|09|antipirat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarescanner08.com (rogue)"; content:"|14|antispywarescanner08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusonlinescan03.com (scareware)"; content:"|15|antivirusonlinescan03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archway-groupinc.cn (malware)"; content:"|10|archway-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avpersona.net (malware)"; content:"|09|avpersona|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellasbar.co.za (malware)"; content:"|09|bellasbar|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belmond.com (malware)"; content:"|07|belmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benber.info (scareware)"; content:"|06|benber|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-topscanner.com (malware)"; content:"|0f|best-topscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-virus-scanner5.com (rogue)"; content:"|13|best-virus-scanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezzpaleva.cn (malware)"; content:"|0a|bezzpaleva|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigamadillo.cn (malware)"; content:"|0b|bigamadillo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biig.net (malware)"; content:"|04|biig|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill-it-now.com (malware)"; content:"|0b|bill-it-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill-service-365.com (malware)"; content:"|10|bill-service-365|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill-solution-365.com (malware)"; content:"|11|bill-solution-365|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billing365solution.com (malware)"; content:"|12|billing365solution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billingsecurepayment.com (malware)"; content:"|14|billingsecurepayment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billmeplease.biz (malware)"; content:"|0c|billmeplease|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billmyccnow.com (malware)"; content:"|0b|billmyccnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billsoftpay.com (malware)"; content:"|0b|billsoftpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billsystem-24.com (malware)"; content:"|0d|billsystem-24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bomkyvi.cn (malware)"; content:"|07|bomkyvi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buhervadonuska.com (malware)"; content:"|0e|buhervadonuska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bukake3890.info (malware)"; content:"|0a|bukake3890|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campani.net (malware)"; content:"|07|campani|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canasta-banditen.de (malware)"; content:"|10|canasta-banditen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cc-pay-system.com (malware)"; content:"|0d|cc-pay-system|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cc-payment-sys24.com (malware)"; content:"|10|cc-payment-sys24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccpaymentsys24.com (malware)"; content:"|0e|ccpaymentsys24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-all-spyware03.com (malware)"; content:"|13|clean-all-spyware03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-all-spyware10.com (scareware)"; content:"|13|clean-all-spyware10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comanda-parfum.com (malware)"; content:"|0e|comanda-parfum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup continental-systems.com (malware)"; content:"|13|continental-systems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2623.ingloriousbastardsx.com (malware)"; content:"|08|core2623|13|ingloriousbastardsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cr0d.interfree.it (malware)"; content:"|04|cr0d|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuantosexo.com (malware)"; content:"|0a|cuantosexo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davidbredov.ru (malware)"; content:"|0b|davidbredov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dayoneskateshop.com (malware)"; content:"|0f|dayoneskateshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demoscan4free.com (malware)"; content:"|0d|demoscan4free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirvsdl.or.kr (phishing)"; content:"|07|dirvsdl|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divambee35.de (malware)"; content:"|0a|divambee35|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dmitrygaiduk.cn (malware)"; content:"|0c|dmitrygaiduk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebator.com (malware)"; content:"|06|ebator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecologygreenpc.com (malware)"; content:"|0e|ecologygreenpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eleparts.co.kr (malware)"; content:"|08|eleparts|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elxolisdonave.com (malware)"; content:"|0d|elxolisdonave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embrari-1.cn (harmful)"; content:"|09|embrari-1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertubredxcong.com (malware)"; content:"|0d|ertubredxcong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-virus-scan01.com (scareware)"; content:"|11|fast-virus-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-virus-scan7.com (malware)"; content:"|10|fast-virus-scan7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigbearproperty.cn (fast_flux)"; content:"|13|findbigbearproperty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firesaverbest.com (malware)"; content:"|0d|firesaverbest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forms.dgpj.mj.pt (malware)"; content:"|05|forms|04|dgpj|02|mj|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.mylinkreview.com (malware)"; content:"|05|forum|0c|mylinkreview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotomasterstvo.ru (malware)"; content:"|0e|fotomasterstvo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-checkpc.com (malware)"; content:"|0c|free-checkpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-scan-pc.us (malware)"; content:"|0c|free-scan-pc|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedom3.cn (malware)"; content:"|08|freedom3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuck-celebrities-movie.com (threat)"; content:"|16|fuck-celebrities-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gemmakt.cn (malware)"; content:"|07|gemmakt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geotisto.info (malware)"; content:"|08|geotisto|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geroyvoin.cn (malware)"; content:"|09|geroyvoin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup git77.biz (malware)"; content:"|05|git77|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-searchandprotect.com (malware)"; content:"|13|go-searchandprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldtraff.info (malware)"; content:"|09|goldtraff|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomasukanahui.com (trojan)"; content:"|0d|gomasukanahui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-week.cn (malware)"; content:"|09|good-week|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googie-stats.com (malware)"; content:"|0c|googie-stats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats008.cn (malware)"; content:"|0f|google-stats008|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorodu.com (malware)"; content:"|06|gorodu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscan-protect.net (scareware)"; content:"|0e|goscan-protect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscantech.com (harmful)"; content:"|0a|goscantech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groupmomsorgies.net (fast_flux)"; content:"|0f|groupmomsorgies|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guotao518.cn (malware)"; content:"|09|guotao518|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harlingens.com (malware)"; content:"|0a|harlingens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hat77.biz (malware)"; content:"|05|hat77|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hearabout.linksysnet.com (malware)"; content:"|09|hearabout|0a|linksysnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hfju38djfhjdi3kd.cn (malware)"; content:"|10|hfju38djfhjdi3kd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hkindoor.com (malware)"; content:"|08|hkindoor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huladopkaert.com (malware)"; content:"|0c|huladopkaert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulieropedaso.com (malware)"; content:"|0d|hulieropedaso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyg12zr.eu (fast_flux)"; content:"|07|hyg12zr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyg12zu.eu (fast_flux)"; content:"|07|hyg12zu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11hec.eu (fast_flux)"; content:"|08|hyu11hec|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11heh.eu (malware)"; content:"|08|hyu11heh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11hej.eu (fast_flux)"; content:"|08|hyu11hej|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu11her.eu (fast_flux)"; content:"|08|hyu11her|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyy12cyl.eu (fast_flux)"; content:"|08|hyy12cyl|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idofrosting.com (malware)"; content:"|0b|idofrosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idunef.cn (malware)"; content:"|06|idunef|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifypeod.cn (malware)"; content:"|07|ifypeod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igivor.cn (malware)"; content:"|06|igivor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijuoxe.cn (malware)"; content:"|06|ijuoxe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indo.home.ro (malware)"; content:"|04|indo|04|home|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingloriousbastardsx.com (malware)"; content:"|13|ingloriousbastardsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrity-groupinc.cn (malware)"; content:"|12|integrity-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrity-groupsvc.cn (malware)"; content:"|12|integrity-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intellectual-vir-scan08.com (malware)"; content:"|17|intellectual-vir-scan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intellectual-vir-scan09.com (malware)"; content:"|17|intellectual-vir-scan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iobacebauiler.com (malware)"; content:"|0d|iobacebauiler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iobacebyuauiler.com (malware)"; content:"|0f|iobacebyuauiler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itorkadflione.com (malware)"; content:"|0d|itorkadflione|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jejucasa.com (malware)"; content:"|08|jejucasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup join2623.softwareordersx.com (malware)"; content:"|08|join2623|0f|softwareordersx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasongskertub.com (malware)"; content:"|0d|kasongskertub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiano-180809.com (harmful)"; content:"|0c|kiano-180809|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kokkosik.com (malware)"; content:"|08|kokkosik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolinhopewaqs.com (malware)"; content:"|0d|kolinhopewaqs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopaeva.servegame.com (malware)"; content:"|07|kopaeva|09|servegame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup korcacity.com (malware)"; content:"|09|korcacity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krommeknilles.nl (malware)"; content:"|0d|krommeknilles|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvumurij.cn (malware)"; content:"|08|kvumurij|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leiayre.cn (malware)"; content:"|07|leiayre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libesouz.ru (malware)"; content:"|08|libesouz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lingobest.com (malware)"; content:"|09|lingobest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionaserduma.com (malware)"; content:"|0c|lionaserduma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionglenhrvoa.com (malware)"; content:"|0d|lionglenhrvoa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listven.com (malware)"; content:"|07|listven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losawzs.eu (malspam)"; content:"|07|losawzs|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareinternetscanner03.com (rogue)"; content:"|18|malwareinternetscanner03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareseradicator.com (malware)"; content:"|12|malwareseradicator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareurlirblock.com (scareware)"; content:"|11|malwareurlirblock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketservers.net (malware)"; content:"|0d|marketservers|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup massive-groupsvc.cc (malware)"; content:"|10|massive-groupsvc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medialabs.it (malware)"; content:"|09|medialabs|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-business-online-shop-2009.com (malware)"; content:"|1e|mega-business-online-shop-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-tracker.info (malware)"; content:"|0c|mega-tracker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mena-groupsvc.cn (malware)"; content:"|0d|mena-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messengerinfo.cn (malware)"; content:"|0d|messengerinfo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milet-company.cn (malware)"; content:"|0d|milet-company|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mredkizerut.com (malware)"; content:"|0b|mredkizerut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtkstrip.co.kr (phishing)"; content:"|08|mtkstrip|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtkstrip.com (phishing)"; content:"|08|mtkstrip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtkstrip.kr (phishing)"; content:"|08|mtkstrip|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muvz.sytes.net (malware)"; content:"|04|muvz|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvdhiraagu.com (malware)"; content:"|0a|mvdhiraagu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylipc.com (malware)"; content:"|06|mylipc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzonedom.ru (malware)"; content:"|09|myzonedom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameguards.cn (malware)"; content:"|0a|nameguards|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nashi-babki2.com (malware)"; content:"|0c|nashi-babki2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-systemguard.com (scareware)"; content:"|0f|new-systemguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-systemprotection.com (scareware)"; content:"|14|new-systemprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-systemprotection.net (scareware)"; content:"|14|new-systemprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newcellphones-overview.com (malware)"; content:"|16|newcellphones-overview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neztro.com (malware)"; content:"|06|neztro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noliporedtre.com (malware)"; content:"|0c|noliporedtre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nosatorabumb.com (malware)"; content:"|0c|nosatorabumb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nrefadoteskfer.com (malware)"; content:"|0e|nrefadoteskfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nulcdiborkawer.com (malware)"; content:"|0e|nulcdiborkawer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup numbergatoriosso.com (malware)"; content:"|10|numbergatoriosso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanandsecure.net (scareware)"; content:"|14|online-scanandsecure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-securescanner.com (scareware)"; content:"|14|online-securescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-systemscan.com (scareware)"; content:"|11|online-systemscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinebillingsolution.net (malware)"; content:"|15|onlinebillingsolution|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinescansystem.net (scareware)"; content:"|10|onlinescansystem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesoftwarebilling.com (malware)"; content:"|15|onlinesoftwarebilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinestoresystem.com (malware)"; content:"|11|onlinestoresystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesystemscan.com (scareware)"; content:"|10|onlinesystemscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesystemscan.net (scareware)"; content:"|10|onlinesystemscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onpromo.cn (malware)"; content:"|07|onpromo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup order-software-online.com (malware)"; content:"|15|order-software-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oretoderfat.com (malware)"; content:"|0b|oretoderfat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overviewforexbids.com (rogue)"; content:"|11|overviewforexbids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovuiobvipolak.com (malware)"; content:"|0d|ovuiobvipolak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oyks.net (malware)"; content:"|04|oyks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pay-cc-24.com (malware)"; content:"|09|pay-cc-24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pay-securesystem.com (malware)"; content:"|10|pay-securesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payment-solution24.com (malware)"; content:"|12|payment-solution24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentsolution24.com (malware)"; content:"|11|paymentsolution24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paysoftbillsolution.com (malware)"; content:"|13|paysoftbillsolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcfsupport.com (malware)"; content:"|0a|pcfsupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pebergenufeska.com (malware)"; content:"|0e|pebergenufeska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pencil-netwok.com (malware)"; content:"|0d|pencil-netwok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal08.com (malware)"; content:"|0a|personal08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personaldetailsinfo.com (phishing)"; content:"|13|personaldetailsinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalpurchuasesite.com (scareware)"; content:"|15|personalpurchuasesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photopath49.de (malware)"; content:"|0b|photopath49|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poavlonini.com (malware)"; content:"|0a|poavlonini|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prikulamud.com (malware)"; content:"|0a|prikulamud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-groupco.cn (malware)"; content:"|0d|prime-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-groupinc.cc (malware)"; content:"|0e|prime-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prime-groupinc.cn (malware)"; content:"|0e|prime-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacyguardpro.com (malware)"; content:"|0f|privacyguardpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup project.usinfolab.net (malware)"; content:"|07|project|09|usinfolab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-check07.com (malware)"; content:"|12|protection-check07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-virus-scanner02.com (scareware)"; content:"|15|quick-virus-scanner02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-virus-scanner07.com (scareware)"; content:"|15|quick-virus-scanner07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-virus-scanner08.com (scareware)"; content:"|15|quick-virus-scanner08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radioheadicon.cn (malware)"; content:"|0d|radioheadicon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdafergfvacex.com (malware)"; content:"|0d|rdafergfvacex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdafervacex.com (malware)"; content:"|0b|rdafervacex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red-wolf.ru (harmful)"; content:"|08|red-wolf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redeye-groupco.cn (malware)"; content:"|0e|redeye-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redeye-groupinc.cc (malware)"; content:"|0f|redeye-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redeye-groupinc.cn (malware)"; content:"|0f|redeye-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retrobaziliona.com (malware)"; content:"|0e|retrobaziliona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhrhrhrhereo.cn (malware)"; content:"|0c|rhrhrhrhereo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjkifj.cn (malware)"; content:"|06|rjkifj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rss-checkfeeds.com (malware)"; content:"|0e|rss-checkfeeds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-fileshere.com (malware)"; content:"|0e|safe-fileshere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saint56.pe.kr (malware)"; content:"|07|saint56|02|pe|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santacruzcall.com (malware)"; content:"|0d|santacruzcall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saturn-groupco.cn (malware)"; content:"|0e|saturn-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saturn-groupsvc.cn (malware)"; content:"|0f|saturn-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdoosdne774bsd3s83bn.com (malware)"; content:"|14|sdoosdne774bsd3s83bn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchgroovy.cn (malware)"; content:"|0c|searchgroovy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searra-ditol.cn (harmful)"; content:"|0c|searra-ditol|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sebastienleabse.com (malware)"; content:"|0f|sebastienleabse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityscantoolguide.com (scareware)"; content:"|15|securityscantoolguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senmu.homeftp.net (malware)"; content:"|05|senmu|07|homeftp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-and-the-city.cn (malware)"; content:"|10|sex-and-the-city|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shounbakerpro.info (malware)"; content:"|0d|shounbakerpro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shrekmovie.cn (malware)"; content:"|0a|shrekmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sigatrio.org (malware)"; content:"|08|sigatrio|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik1.com (malware)"; content:"|07|slavik1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slyusarenko.kicks-ass.org (malware)"; content:"|0b|slyusarenko|09|kicks-ass|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-online-shop.com (malware)"; content:"|11|smart-online-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smarttech-house.net (malware)"; content:"|0f|smarttech-house|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sms-vkontakte.ru (malware)"; content:"|0d|sms-vkontakte|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sockslab.net (malware)"; content:"|08|sockslab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-process.com (malware)"; content:"|0c|soft-process|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softhotspot.com (malware)"; content:"|0b|softhotspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareordersx.com (malware)"; content:"|0f|softwareordersx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spasicomp.com (malware)"; content:"|09|spasicomp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srvfarino.co.cr (malware)"; content:"|09|srvfarino|02|co|02|cr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup step2me.net (malware)"; content:"|07|step2me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup street-peppers.ru (malware)"; content:"|0e|street-peppers|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup styleorient.dnsalias.org (malware)"; content:"|0b|styleorient|08|dnsalias|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunshinecoasttours.selfip.net (malware)"; content:"|12|sunshinecoasttours|06|selfip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superb-antivir-scan01.com (malware)"; content:"|15|superb-antivir-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taborfilmfestival.com (malware)"; content:"|11|taborfilmfestival|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tahulavubgmbak.com (malware)"; content:"|0e|tahulavubgmbak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiete.com.br (malware)"; content:"|05|tiete|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiondapulkat.com (malware)"; content:"|0c|tiondapulkat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup total-groupli.cn (malware)"; content:"|0d|total-groupli|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalgroupinc.cn (malware)"; content:"|0d|totalgroupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tour.ivancity.com (malware)"; content:"|04|tour|08|ivancity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traceback-ip.eu (malware)"; content:"|0c|traceback-ip|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradenton.com (malware)"; content:"|09|tradenton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trufficseovciezlocovnert.com (malware)"; content:"|18|trufficseovciezlocovnert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tudoaqui2.xpg.com.br (malware)"; content:"|09|tudoaqui2|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbo-profit.com (malware)"; content:"|0c|turbo-profit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhajokvfalesko.com (malware)"; content:"|0e|uhajokvfalesko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukwirex.info (malware)"; content:"|07|ukwirex|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upinosatoretr.com (malware)"; content:"|0d|upinosatoretr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upwize.info (malware)"; content:"|06|upwize|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utionakertu.com (malware)"; content:"|0b|utionakertu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup validating.ru (malware)"; content:"|0a|validating|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtualsecuritycheck.com (scareware)"; content:"|14|virtualsecuritycheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volonterkom.cn (malware)"; content:"|0b|volonterkom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningdt.nm.ru (malware)"; content:"|09|warningdt|02|nm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup washingtontruth.com (malware)"; content:"|0f|washingtontruth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wertagulionaders.com (malware)"; content:"|10|wertagulionaders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yamagiku.net (malware)"; content:"|08|yamagiku|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesfreescan.com (malware)"; content:"|0b|yesfreescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 094k.ofspokesman.com (malicious)"; content:"|04|094k|0b|ofspokesman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 09computerquickscan.com (rogue)"; content:"|13|09computerquickscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0md.ru (zeus)"; content:"|03|0md|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2ijdi.cn (malware)"; content:"|05|2ijdi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2sdfhs8d7fsh34d8f7s.org (malware)"; content:"|13|2sdfhs8d7fsh34d8f7s|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3eifj.cn (malware)"; content:"|05|3eifj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4e4en.com (rogue)"; content:"|05|4e4en|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abyvauw.cn (rogue)"; content:"|07|abyvauw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad-warealert.com (rogue)"; content:"|0c|ad-warealert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adjudg.info (koobface_botnet)"; content:"|06|adjudg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adoimi.cn (malware)"; content:"|06|adoimi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adspromo.cn (zeus)"; content:"|08|adspromo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aflamsat.com (malware)"; content:"|08|aflamsat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agoliopaner.com (malware)"; content:"|0b|agoliopaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anmast.info (koobface_botnet)"; content:"|06|anmast|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup argier.info (koobface_botnet)"; content:"|06|argier|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atwain.info (koobface_botnet)"; content:"|06|atwain|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedash.info (koobface_botnet)"; content:"|06|bedash|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bianca.trinityonline.biz (koobface_botnet)"; content:"|06|bianca|0d|trinityonline|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botled.info (koobface_botnet)"; content:"|06|botled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broths.info (koobface_botnet)"; content:"|06|broths|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camlet.info (koobface_botnet)"; content:"|06|camlet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caretz.info (koobface_botnet)"; content:"|06|caretz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crusade-affiliates.com (koobface_botnet)"; content:"|12|crusade-affiliates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuplift.info (koobface_botnet)"; content:"|07|cuplift|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debuty.info (koobface_botnet)"; content:"|06|debuty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup declin.info (koobface_botnet)"; content:"|06|declin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dercleaner.info (koobface_botnet)"; content:"|0a|dercleaner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devicel.info (koobface_botnet)"; content:"|07|devicel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolchi.info (koobface_botnet)"; content:"|06|dolchi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dot-soft.net (zeus)"; content:"|08|dot-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotastoc.com (rogue)"; content:"|08|dotastoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dz-hacker.com (malware)"; content:"|09|dz-hacker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eljupdate.info (koobface_botnet)"; content:"|09|eljupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrip.info (koobface_botnet)"; content:"|06|extrip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-virus-scan4.com (rogue)"; content:"|10|fast-virus-scan4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatted.info (koobface_botnet)"; content:"|06|fatted|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fifthz.info (koobface_botnet)"; content:"|06|fifthz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filths.info (koobface_botnet)"; content:"|06|filths|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fosset.info (koobface_botnet)"; content:"|06|fosset|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freckl.info (koobface_botnet)"; content:"|06|freckl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fulier.info (koobface_botnet)"; content:"|06|fulier|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaudad.info (koobface_botnet)"; content:"|06|gaudad|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gelded.info (koobface_botnet)"; content:"|06|gelded|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfr24.com (malware)"; content:"|05|gfr24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghterwa.com (malware)"; content:"|07|ghterwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotrioscan.com (koobface_botnet)"; content:"|0a|gotrioscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsm.tehnogold.ru (zeus)"; content:"|03|gsm|09|tehnogold|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haere.info (koobface_botnet)"; content:"|05|haere|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiccanaght.com (rogue)"; content:"|0a|hiccanaght|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiccanaght.net (rogue)"; content:"|0a|hiccanaght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjc.or.kr (malware)"; content:"|03|hjc|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdit.info (koobface_botnet)"; content:"|06|holdit|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostned.ws (malware)"; content:"|07|hostned|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hownet.info (koobface_botnet)"; content:"|06|hownet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqvirusscanner.com (rogue)"; content:"|0e|hqvirusscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqvirusscanner5.com (rogue)"; content:"|0f|hqvirusscanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqvirusscanner7.com (rogue)"; content:"|0f|hqvirusscanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqvirusscanner8.com (rogue)"; content:"|0f|hqvirusscanner8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hundenhuete.com (rogue)"; content:"|0b|hundenhuete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ia-pro.com (koobface_botnet)"; content:"|06|ia-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iantivirus-pro.com (koobface_botnet)"; content:"|0e|iantivirus-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iantiviruspro.com (koobface_botnet)"; content:"|0d|iantiviruspro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihagoin.cn (rogue)"; content:"|07|ihagoin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijnphysght.com (rogue)"; content:"|0a|ijnphysght|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijobuaw.cn (rogue)"; content:"|07|ijobuaw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikoiwe.cn (rogue)"; content:"|06|ikoiwe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikorate.cn (rogue)"; content:"|07|ikorate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikyadeh.cn (rogue)"; content:"|07|ikyadeh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikyigy.cn (rogue)"; content:"|06|ikyigy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inquir.info (koobface_botnet)"; content:"|06|inquir|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inversiontrace.com (zeus)"; content:"|0e|inversiontrace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investmenttooltips.com (malware)"; content:"|12|investmenttooltips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iron-words.info (malware)"; content:"|0a|iron-words|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaagobangladesh.com (malware)"; content:"|0f|jaagobangladesh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaesupgght.net (rogue)"; content:"|0a|jaesupgght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaoxiavght.net (rogue)"; content:"|0a|jaoxiavght|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdreborn.co.uk (malware)"; content:"|08|jdreborn|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jornalinparcial.com.br (malware)"; content:"|0f|jornalinparcial|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpchase.cn (zeus)"; content:"|07|jpchase|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrigutto.com (malware)"; content:"|08|jrigutto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup junior-cup.de (malware)"; content:"|0a|junior-cup|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justintimberlake2009.cn (rogue)"; content:"|14|justintimberlake2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justseethisonline.com (malware)"; content:"|11|justseethisonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karmandala.com (malware)"; content:"|0a|karmandala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasonkertub.com (malware)"; content:"|0b|kasonkertub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kedder.info (koobface_botnet)"; content:"|06|kedder|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ki2ip.cn (malware)"; content:"|05|ki2ip|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kievsk.com (malware)"; content:"|06|kievsk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kilibinchek.cn (zeus)"; content:"|0b|kilibinchek|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klozep.net (malware)"; content:"|06|klozep|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knivel.info (koobface_botnet)"; content:"|06|knivel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopol.com.ar (malware)"; content:"|05|kopol|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpu.feelmuziq.com (malware)"; content:"|03|kpu|09|feelmuziq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krapen.info (koobface_botnet)"; content:"|06|krapen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ksakksik.cn (zeus)"; content:"|08|ksakksik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kult.si (malware)"; content:"|04|kult|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kurskoi.com (zeus)"; content:"|07|kurskoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l2707.com (malware)"; content:"|05|l2707|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labor.labcei.unimore.it (malware)"; content:"|05|labor|06|labcei|07|unimore|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lafikhex.cn (malware)"; content:"|08|lafikhex|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamorecosmetics.com (zeus)"; content:"|0f|lamorecosmetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamsa1.com (zeus)"; content:"|06|lamsa1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastexe.com (malicious)"; content:"|07|lastexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastexesite.com (malicious)"; content:"|0b|lastexesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavyer.info (koobface_botnet)"; content:"|06|lavyer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liifd.cn (zeus)"; content:"|05|liifd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lilia.jino.ru (malware)"; content:"|05|lilia|04|jino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litsed.cn (zeus)"; content:"|06|litsed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllllllll.info (zeus)"; content:"|09|lllllllll|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnx.mp3dmultimediastudio.it (malware)"; content:"|03|lnx|14|mp3dmultimediastudio|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locationlite.com (malware)"; content:"|0c|locationlite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loginup.cn (malware)"; content:"|07|loginup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsdc.be (malware)"; content:"|04|lsdc|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxexe.com (malicious)"; content:"|06|luxexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicsuser.net (malware)"; content:"|0a|magicsuser|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malogrado.de (malware)"; content:"|09|malogrado|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamasanta.com (malware)"; content:"|09|mamasanta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup management-overview.com (malware)"; content:"|13|management-overview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mauds.co.uk (malware)"; content:"|05|mauds|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mayray.info (koobface_botnet)"; content:"|06|mayray|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media1950.cn (zeus)"; content:"|09|media1950|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaspywarescan2.com (malware)"; content:"|10|megaspywarescan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membres.lycos.fr (malware)"; content:"|07|membres|05|lycos|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meyrie.info (koobface_botnet)"; content:"|06|meyrie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg0b.info (malware)"; content:"|04|mg0b|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millionmany.org (zeus)"; content:"|0b|millionmany|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miloty.info (koobface_botnet)"; content:"|06|miloty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirstor.cn (malware)"; content:"|07|mirstor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mknjbhyju.exxl.pl (rogue)"; content:"|09|mknjbhyju|04|exxl|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moskaritobanios.com (malware)"; content:"|0f|moskaritobanios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mravinsky.ru (malware)"; content:"|09|mravinsky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mt3pvkfmpi7de.cm (koobface_botnet)"; content:"|0d|mt3pvkfmpi7de|02|cm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup museum-mputantular.com (malware)"; content:"|12|museum-mputantular|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybetorwager.cn (rogue)"; content:"|0c|mybetorwager|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotected-zone.net (scareware)"; content:"|10|myprotected-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myth-busters.cn (rogue)"; content:"|0c|myth-busters|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myvirusscanner.net (rogue)"; content:"|0e|myvirusscanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n0one.com (zeus)"; content:"|05|n0one|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namethatshop.cn (rogue)"; content:"|0c|namethatshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narowz.info (koobface_botnet)"; content:"|06|narowz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nevils.info (koobface_botnet)"; content:"|06|nevils|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newwayscanner.info (malware)"; content:"|0d|newwayscanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordicholidayhomes.nl (malware)"; content:"|12|nordicholidayhomes|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novoxexe.com (malicious)"; content:"|08|novoxexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntrytodownload.info (malware)"; content:"|0e|ntrytodownload|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup numben.info (scareware)"; content:"|06|numben|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiluk.net (malware)"; content:"|05|oiluk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onclew.info (scareware)"; content:"|06|onclew|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orodes.info (koobface_botnet)"; content:"|06|orodes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osaertugern.com (malware)"; content:"|0b|osaertugern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outliv.info (koobface_botnet)"; content:"|06|outliv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pampa.hu (malware)"; content:"|05|pampa|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup penvie.info (koobface_botnet)"; content:"|06|penvie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piisp.com (zeus)"; content:"|05|piisp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinua.com (malware)"; content:"|05|pinua|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pittie.info (koobface_botnet)"; content:"|06|pittie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plamet.info (koobface_botnet)"; content:"|06|plamet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plazec.info (koobface_botnet)"; content:"|06|plazec|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleasagain.com (zeus)"; content:"|0a|pleasagain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup potinz.info (koobface_botnet)"; content:"|06|potinz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prarie.info (koobface_botnet)"; content:"|06|prarie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preserveatetowah.com (malware)"; content:"|10|preserveatetowah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primemovier.net (zeus)"; content:"|0b|primemovier|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promodelia.com (malware)"; content:"|0a|promodelia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psmellc.org (malware)"; content:"|07|psmellc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psycho.lv (zeus)"; content:"|06|psycho|02|lv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quoifs.info (koobface_botnet)"; content:"|06|quoifs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raught.info (koobface_botnet)"; content:"|06|raught|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refleksltd.org (zeus)"; content:"|0a|refleksltd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rh4df.cn (malware)"; content:"|05|rh4df|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rosariofutbol.com (malware)"; content:"|0d|rosariofutbol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rustat.su (malware)"; content:"|06|rustat|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rvertundfertug.com (malware)"; content:"|0e|rvertundfertug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryacleaner.info (koobface_botnet)"; content:"|0a|ryacleaner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sangrokwon.or.kr (malware)"; content:"|0a|sangrokwon|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sawme.info (koobface_botnet)"; content:"|05|sawme|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-virus.net (scareware)"; content:"|0a|scan-virus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scarre.info (koobface_botnet)"; content:"|06|scarre|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scrowl.info (koobface_botnet)"; content:"|06|scrowl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-protect.net (scareware)"; content:"|0e|search-protect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchpcguard.net (scareware)"; content:"|0d|searchpcguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seca.ws (zeus)"; content:"|04|seca|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securefileshere.com (malware)"; content:"|0f|securefileshere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityscantoolworld.com (rogue)"; content:"|15|securityscantoolworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolworld.com (scareware)"; content:"|11|securitytoolworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop.kbench.com (malware)"; content:"|04|shop|06|kbench|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sighal.info (koobface_botnet)"; content:"|06|sighal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sigura.ro (malware)"; content:"|06|sigura|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silvton.cn (malware)"; content:"|07|silvton|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjkmerirtokm.cn (rogue)"; content:"|0c|sjkmerirtokm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skylog.kz (malware)"; content:"|06|skylog|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik2.com (zeus)"; content:"|07|slavik2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik3.com (zeus)"; content:"|07|slavik3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solnamu.com (malware)"; content:"|07|solnamu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somfaigabor.hu (zeus)"; content:"|0b|somfaigabor|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacecountry.cn (zeus)"; content:"|0c|spacecountry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speen.info (koobface_botnet)"; content:"|05|speen|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportime.co.kr (malware)"; content:"|08|sportime|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportshots.cn (zeus)"; content:"|0a|sportshots|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stampo.info (koobface_botnet)"; content:"|06|stampo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startexcite.com (malicious)"; content:"|0b|startexcite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startexe.com (malicious)"; content:"|08|startexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steepy.info (koobface_botnet)"; content:"|06|steepy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sterlate.com (malware)"; content:"|08|sterlate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stikkso.com (zeus)"; content:"|07|stikkso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subsul.com (zeus)"; content:"|06|subsul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summertoday.com (zeus)"; content:"|0b|summertoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supertubeworks.com (malware)"; content:"|0e|supertubeworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swoons.info (koobface_botnet)"; content:"|06|swoons|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sycamorecanyonschool.com (malware)"; content:"|14|sycamorecanyonschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-guard.com (scareware)"; content:"|0c|system-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systguard2009.com (malware)"; content:"|0d|systguard2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syukadig.cn (malware)"; content:"|08|syukadig|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tahulavumbak.com (malware)"; content:"|0c|tahulavumbak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tandkof.cn (zeus)"; content:"|07|tandkof|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teacherslounge.cn (malware)"; content:"|0e|teacherslounge|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tech44tech.com (malware)"; content:"|0a|tech44tech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tented.info (koobface_botnet)"; content:"|06|tented|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thingre.com (malware)"; content:"|07|thingre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ticedu.info (koobface_botnet)"; content:"|06|ticedu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tithed.info (koobface_botnet)"; content:"|06|tithed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tobaco.name (malware)"; content:"|06|tobaco|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toprambler.biz (malware)"; content:"|0a|toprambler|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalunix.net (malware)"; content:"|09|totalunix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup train-modelisme.com (malware)"; content:"|0f|train-modelisme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trimecs.net (zeus)"; content:"|07|trimecs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryantivirusscan.com (malware)"; content:"|10|tryantivirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0asd9fua0sd8fuasdf.org (zeus)"; content:"|13|u0asd9fua0sd8fuasdf|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uintoo.ru (malware)"; content:"|06|uintoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiskddcuiretog.com (rogue)"; content:"|0e|uiskddcuiretog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uliboktebededmakar.com (rogue)"; content:"|12|uliboktebededmakar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uliondarvasoka.com (malicious)"; content:"|0e|uliondarvasoka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uliya737.freehostia.com (zeus)"; content:"|08|uliya737|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uloumir.cn (rogue)"; content:"|07|uloumir|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unclin.info (koobface_botnet)"; content:"|06|unclin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup undeaf.info (koobface_botnet)"; content:"|06|undeaf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup univpancasila.ac.id (malware)"; content:"|0d|univpancasila|02|ac|02|id"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unwept.info (koobface_botnet)"; content:"|06|unwept|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urlupdate.info (malware)"; content:"|09|urlupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us-business-shop-2019.com (malware)"; content:"|15|us-business-shop-2019|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usdisturbed.cn (rogue)"; content:"|0b|usdisturbed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usesomescents.com (zeus)"; content:"|0d|usesomescents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usicam.info (koobface_botnet)"; content:"|06|usicam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vin4enso.cz8.ru (malware)"; content:"|08|vin4enso|03|cz8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtuozbilnyak.cn (zeus)"; content:"|0e|virtuozbilnyak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vklom.com (malware)"; content:"|05|vklom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w0rk.biz (malware)"; content:"|04|w0rk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weeeeeld.com (rogue)"; content:"|08|weeeeeld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wejlk298798324.cn (rogue)"; content:"|0e|wejlk298798324|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wg879.cn (rogue)"; content:"|05|wg879|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wificafe-search.com (malware)"; content:"|0f|wificafe-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowspcline.cn (zeus)"; content:"|0d|windowspcline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winspycleaner.com (rogue)"; content:"|0d|winspycleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiving.info (koobface_botnet)"; content:"|06|wiving|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woptimizer.com (koobface_botnet)"; content:"|0a|woptimizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldbestonlinescan5.com (malware)"; content:"|14|worldbestonlinescan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldbestonlinescan9.com (rogue)"; content:"|14|worldbestonlinescan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldbestonlinescanner.com (rogue)"; content:"|16|worldbestonlinescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwzapas.cn (malware)"; content:"|08|wwwzapas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wzand.info (koobface_botnet)"; content:"|05|wzand|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-pager.com (malware)"; content:"|07|x-pager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x83.ru (zeus)"; content:"|03|x83|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcuidflofertun.com (malware)"; content:"|0e|xcuidflofertun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsconceptgolf.com (malware)"; content:"|0d|xsconceptgolf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xsddss.net (malware)"; content:"|06|xsddss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyu-bam.cn (malware)"; content:"|07|xyu-bam|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yournamequickshop.cn (rogue)"; content:"|11|yournamequickshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaiki.biz (malware)"; content:"|05|zaiki|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zellmada.co.cc (malware)"; content:"|08|zellmada|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeromagic.spb.ru (zeus)"; content:"|09|zeromagic|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoldtermekek.hu (malware)"; content:"|0c|zoldtermekek|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zussia.info (koobface_botnet)"; content:"|06|zussia|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knizhechka.info (zlob)"; content:"|0a|knizhechka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolonochka.info (zlob)"; content:"|0a|kolonochka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lisyonok.org (zlob)"; content:"|08|lisyonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-alarm.com (coolwebsearch)"; content:"|0d|malware-alarm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medvezhonok.org (zlob)"; content:"|0b|medvezhonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olenyonok.org (zlob)"; content:"|09|olenyonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaychonok.org (zlob)"; content:"|09|zaychonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zubryonok.org (zlob)"; content:"|09|zubryonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 001yourprivatescanner.com (rogue)"; content:"|15|001yourprivatescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 005threats-scanner.com (rogue)"; content:"|12|005threats-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 006all-scanner.com (rogue)"; content:"|0e|006all-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 009all-scanner.com (rogue)"; content:"|0e|009all-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 01malwarescan.com (harmful)"; content:"|0d|01malwarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 07malwarescan.com (rogue)"; content:"|0d|07malwarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10-open-davinci.com (malware)"; content:"|0f|10-open-davinci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 245a34.cn (malware)"; content:"|06|245a34|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2e7860.cn (malware)"; content:"|06|2e7860|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33duraka.info (exploits)"; content:"|08|33duraka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3removespyware.com (malware)"; content:"|0e|3removespyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4cleanspyware.com (malware)"; content:"|0d|4cleanspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4malwarescan.com (rogue)"; content:"|0c|4malwarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5removespyware.com (malware)"; content:"|0e|5removespyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6cleanspyware.com (malware)"; content:"|0d|6cleanspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7cleanspyware.com (malware)"; content:"|0d|7cleanspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7removespyware.com (malware)"; content:"|0e|7removespyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8removespyware.com (malware)"; content:"|0e|8removespyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9821g9.cn (malware)"; content:"|06|9821g9|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adeptofmastery.cn (malware)"; content:"|0e|adeptofmastery|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultping.net (exploit)"; content:"|09|adultping|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-my-pc-scan.com (malware)"; content:"|12|antivir-my-pc-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-scan-my-pc.com (malware)"; content:"|12|antivir-scan-my-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-scan-online.com (malware)"; content:"|13|antivir-scan-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirscanmycomputer.com (malware)"; content:"|15|antivirscanmycomputer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-promo-scan1.com (malware)"; content:"|15|antivirus-promo-scan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-promo-scan9.com (malware)"; content:"|15|antivirus-promo-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-promo-scanner3.com (malware)"; content:"|18|antivirus-promo-scanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusxppro-2009.com (malware)"; content:"|13|antivirusxppro-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awardantivirusscan.com (malware)"; content:"|12|awardantivirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banner09092.com (malware)"; content:"|0b|banner09092|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup batman-comics.cn (malware)"; content:"|0d|batman-comics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup becomemybestfriend.com (malware)"; content:"|12|becomemybestfriend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bernie-madoff.coolinc.info (malware)"; content:"|0d|bernie-madoff|07|coolinc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scanpc.com (malware)"; content:"|0b|best-scanpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanpc.info (malware)"; content:"|0a|bestscanpc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanpc.org (malware)"; content:"|0a|bestscanpc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beststarwars.cn (rogue)"; content:"|0c|beststarwars|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestwishestoyou.cn (rogue)"; content:"|0f|bestwishestoyou|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bewareofvirusattacks.com (malware)"; content:"|14|bewareofvirusattacks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bewareofvirusattacks3.com (malware)"; content:"|15|bewareofvirusattacks3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bintus-bahi.cn (exploit)"; content:"|0b|bintus-bahi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackwter-cuprumworks.net (malware)"; content:"|15|blackwter-cuprumworks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blastertroops2011.com (malware)"; content:"|11|blastertroops2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blue-xxx-tube.com (malware)"; content:"|0d|blue-xxx-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulkdvdreader.cn (malware)"; content:"|0d|bulkdvdreader|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capitalofficeautomation.com (rogue)"; content:"|17|capitalofficeautomation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinafavorites.cn (malware)"; content:"|0e|chinafavorites|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cncdatanetwork.cn (zeus)"; content:"|0e|cncdatanetwork|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnn-bcc2.com (malware)"; content:"|08|cnn-bcc2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colonizemoon2010.com (malware)"; content:"|10|colonizemoon2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confsonort.ru (zeus)"; content:"|0a|confsonort|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criticalmentality.com (malware)"; content:"|11|criticalmentality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkbitz.com (zeus)"; content:"|08|darkbitz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete-all-virus01.com (rogue)"; content:"|12|delete-all-virus01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete-all-virus03.com (rogue)"; content:"|12|delete-all-virus03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete-all-virus07.com (rogue)"; content:"|12|delete-all-virus07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete-all-virus09.com (rogue)"; content:"|12|delete-all-virus09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr.com (malware)"; content:"|0b|downloadavr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr2.com (malware)"; content:"|0c|downloadavr2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzuqiqaz.cn (exploit)"; content:"|08|dzuqiqaz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eenadu-epaper.hmsite.net (malware)"; content:"|0d|eenadu-epaper|06|hmsite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emphasis-online.com (malware)"; content:"|0f|emphasis-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ericwanhouse.cn (exploit)"; content:"|0c|ericwanhouse|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exceldocumentsinfo.cn (malware)"; content:"|12|exceldocumentsinfo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup executive-officers.com (malware)"; content:"|12|executive-officers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-systemguard.net (rogue)"; content:"|10|fast-systemguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup festivalamazonasjazz.com.br (rfi)"; content:"|14|festivalamazonasjazz|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fffkkeee.info (luckysploit)"; content:"|08|fffkkeee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstspywarescannerv1.com (malware)"; content:"|15|firstspywarescannerv1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fornistan.cn (exploit)"; content:"|09|fornistan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futureshortsonline.com (malware)"; content:"|12|futureshortsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getrequesttrest.com (zeus)"; content:"|0f|getrequesttrest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatsecuritytestinternet.com (harmful)"; content:"|19|greatsecuritytestinternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattime2009.cn (malware)"; content:"|0d|greattime2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-av-pre.com (rogue)"; content:"|0c|green-av-pre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hallecodecdivx.com (harmful)"; content:"|0e|hallecodecdivx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happy-winners.de (rfi)"; content:"|0d|happy-winners|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoooools.com (exploit)"; content:"|08|hoooools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphotos.ir (zeus)"; content:"|07|iphotos|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqiatwo.cn (rogue)"; content:"|07|iqiatwo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqidoh.cn (rogue)"; content:"|06|iqidoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqoyxab.cn (rogue)"; content:"|07|iqoyxab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs.gov.ikbas1.eu (zeus)"; content:"|03|irs|03|gov|06|ikbas1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irs.gov.yh1wek.eu (zeus)"; content:"|03|irs|03|gov|06|yh1wek|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issuenews1.com (rogue)"; content:"|0a|issuenews1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itorkalione.com (braviax)"; content:"|0b|itorkalione|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwanttowin.cn (malware)"; content:"|0a|iwanttowin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j-vintage.com (rfi)"; content:"|09|j-vintage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jahanradio.com (rfi)"; content:"|0a|jahanradio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jorgan.info (suspicious)"; content:"|06|jorgan|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justintimberlakestream.com (malware)"; content:"|16|justintimberlakestream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justthingsyouneedtoknow.com (malware)"; content:"|17|justthingsyouneedtoknow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kebike.co.kr (exploits)"; content:"|06|kebike|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kilogid2.biz (exploits)"; content:"|08|kilogid2|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingofrings.info (zeus)"; content:"|0b|kingofrings|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kowpa.x-y.net (rfi)"; content:"|05|kowpa|03|x-y|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpaxikey.cn (trojan)"; content:"|08|kpaxikey|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leading-antispyware-scan.com (malware)"; content:"|18|leading-antispyware-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leading-antivirus-scan.com (malware)"; content:"|16|leading-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifecounter.cn (zeus)"; content:"|0b|lifecounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionglervoa.com (braviax)"; content:"|0b|lionglervoa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrxsoft.info (harmful)"; content:"|07|lrxsoft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magictin.cn (zeus)"; content:"|08|magictin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup managetelevision.com (malware)"; content:"|10|managetelevision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup materetcaput.it (iframe)"; content:"|0c|materetcaput|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediastreamdata.net (trojan)"; content:"|0f|mediastreamdata|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaspywarescan.com (malware)"; content:"|0f|megaspywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaspywarescan5.com (malware)"; content:"|10|megaspywarescan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modern-design.cn (trojan)"; content:"|0d|modern-design|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mofa.go.ug (trojan)"; content:"|04|mofa|02|go|02|ug"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediahomesoft.com (trojan)"; content:"|12|multimediahomesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicanacional.com (trojan)"; content:"|0e|musicanacional|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-protectedzone.com (rogue)"; content:"|10|my-protectedzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-protectedzone.net (rogue)"; content:"|10|my-protectedzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymoney-blog.ru (trojan)"; content:"|0c|mymoney-blog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotection-zone.net (rogue)"; content:"|11|myprotection-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotectionzone.com (rogue)"; content:"|10|myprotectionzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystem-protection.net (rogue)"; content:"|13|mysystem-protection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystemprotection.com (rogue)"; content:"|12|mysystemprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystemprotection.net (rogue)"; content:"|12|mysystemprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationaltreasure.cn (malware)"; content:"|10|nationaltreasure|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbakoff.com (exploits)"; content:"|07|nbakoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newscnn2009.com (malware)"; content:"|0b|newscnn2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoption.biz (malicious)"; content:"|0a|newsoption|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoverworldhot.com (malware)"; content:"|10|newsoverworldhot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nfovidab.cn (exploit)"; content:"|08|nfovidab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnieqee.info (luckysploit)"; content:"|07|nnieqee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup norma-market.ru (pdf_exploit)"; content:"|0c|norma-market|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noronha.pe.gov.br (rfi)"; content:"|07|noronha|02|pe|03|gov|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novaetc.com (trojan)"; content:"|07|novaetc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obamanewterror.com (malware)"; content:"|0e|obamanewterror|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obbeytheriver.com (malware)"; content:"|0d|obbeytheriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-systemscan.net (threat)"; content:"|11|online-systemscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poligraphiya.cn (zeus)"; content:"|0c|poligraphiya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-virus-scannerv2.com (malware)"; content:"|15|power-virus-scannerv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primeareanetworks.com (malware)"; content:"|11|primeareanetworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remove-all-pc-adware.com (malware)"; content:"|14|remove-all-pc-adware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rootscan.info (malware)"; content:"|08|rootscan|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rover-machine.cn (malware)"; content:"|0d|rover-machine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savemywork.net (zeus)"; content:"|0a|savemywork|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search890.com (exploit)"; content:"|09|search890|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.web-software-payments.com (malware)"; content:"|06|secure|15|web-software-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedvirusproscanner.com (malware)"; content:"|16|securedvirusproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedvirusscan.com (malware)"; content:"|10|securedvirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexualporno.ru (iframe)"; content:"|0b|sexualporno|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shaurman.com (zeus)"; content:"|08|shaurman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitemechanics.cn (malware)"; content:"|0d|sitemechanics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space2009city.cn (rogue)"; content:"|0d|space2009city|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportyourcountry.cn (malware)"; content:"|12|supportyourcountry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalsecurityscannerv3.com (malware)"; content:"|16|totalsecurityscannerv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalspywarescan.com (malware)"; content:"|10|totalspywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalspywarescan3.com (malware)"; content:"|11|totalspywarescan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalspywarescan4.com (malware)"; content:"|11|totalspywarescan4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalspywarescan5.com (malware)"; content:"|11|totalspywarescan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalvirusscanc3.com (malware)"; content:"|10|totalvirusscanc3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trucount3005.com (malware)"; content:"|0c|trucount3005|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trucountme.com (malware)"; content:"|0a|trucountme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustsusyem-protection.com (rogue)"; content:"|16|trustsusyem-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryantivir-scan.com (malware)"; content:"|0f|tryantivir-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryantivir-scanner.com (malware)"; content:"|12|tryantivir-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryantivirscanner.com (malware)"; content:"|11|tryantivirscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryantivirusscanner.com (malware)"; content:"|13|tryantivirusscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trytowintoday.cn (malware)"; content:"|0d|trytowintoday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukwirex.com (zeus)"; content:"|07|ukwirex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukwirex.ws (zeus)"; content:"|07|ukwirex|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniqstats.net (exploit)"; content:"|09|uniqstats|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uptodate-your-system.com (rogue)"; content:"|14|uptodate-your-system|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usanews2009.com (malware)"; content:"|0b|usanews2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustintimberlakestream.com (malware)"; content:"|15|ustintimberlakestream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valueantivirusshop1.com (malware)"; content:"|13|valueantivirusshop1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virscan-live1.com (malware)"; content:"|0d|virscan-live1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virscan-online1.com (malware)"; content:"|0f|virscan-online1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waitforsunrise.com (malware)"; content:"|0e|waitforsunrise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningmalwarealert.com (malware)"; content:"|13|warningmalwarealert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningmalwarealert2.com (malware)"; content:"|14|warningmalwarealert2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningmalwarealert5.com (malware)"; content:"|14|warningmalwarealert5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningspywarealert.com (malware)"; content:"|13|warningspywarealert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningvirusalert.com (malware)"; content:"|11|warningvirusalert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warningvirusspreads.com (malware)"; content:"|13|warningvirusspreads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch2010movies.com (malware)"; content:"|0f|watch2010movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wheels-on-fire.cn (malware)"; content:"|0e|wheels-on-fire|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup willsmithinc.cn (malware)"; content:"|0c|willsmithinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-protectionsuite.net (malware)"; content:"|17|windows-protectionsuite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-shield.com (malware)"; content:"|0e|windows-shield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotection-9.com (malware)"; content:"|13|windowsprotection-9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winnerphone.cn (malware)"; content:"|0b|winnerphone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winningantivirusscan.com (malware)"; content:"|14|winningantivirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldrolemodeling.com (malware)"; content:"|11|worldrolemodeling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsbestantivirscan.com (malware)"; content:"|15|worldsbestantivirscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsbestscan.com (malware)"; content:"|0e|worldsbestscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsbestscanner.com (malware)"; content:"|11|worldsbestscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xillercollection.biz (zeus)"; content:"|10|xillercollection|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxx-white-tube.com (malware)"; content:"|0e|xxx-white-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabanyonok.org (zlob)"; content:"|0a|kabanyonok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 563f235.cn (exploits)"; content:"|07|563f235|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6malwarescan.com (rogue)"; content:"|0c|6malwarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 849jfg.com (malware)"; content:"|06|849jfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 888b123.cn (malware)"; content:"|07|888b123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 99c342.cn (malware)"; content:"|06|99c342|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaeg.ru (malware)"; content:"|04|aaeg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup add-block-11.info (exploits)"; content:"|0c|add-block-11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adicionaamigork2.webcindario.com (rfi)"; content:"|10|adicionaamigork2|0b|webcindario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afedovascevo.com (braviax)"; content:"|0c|afedovascevo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affina-groupnet.cn (fraud-scam)"; content:"|0f|affina-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affina-groupnet.com (fraud-scam)"; content:"|0f|affina-groupnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affina-groupsvc.cc (fraud-scam)"; content:"|0f|affina-groupsvc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup affina-groupsvc.cn (fraud-scam)"; content:"|0f|affina-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup age-free.ru (malware)"; content:"|08|age-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akvaryumizmir.com (rfi)"; content:"|0d|akvaryumizmir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aleksandrhomepage.com (malware)"; content:"|11|aleksandrhomepage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allradiohits.com (malware)"; content:"|0c|allradiohits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ame.com.au (trojan)"; content:"|03|ame|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analytic-manager.org (harmful)"; content:"|10|analytic-manager|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annuity-groupllc.cn (fraud-scam)"; content:"|10|annuity-groupllc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annuity-groupllc.com (fraud-scam)"; content:"|10|annuity-groupllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annuity-groupnet.cc (fraud-scam)"; content:"|10|annuity-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annuity-groupnet.cn (fraud-scam)"; content:"|10|annuity-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaretotalscan5.com (rogue)"; content:"|15|antispywaretotalscan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruscontraviro.com (rogue)"; content:"|13|antiviruscontraviro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqobeyv.cn (malware)"; content:"|07|aqobeyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autoonlineadvisor.net (malware)"; content:"|11|autoonlineadvisor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviraplatinum.com (rogue)"; content:"|0d|aviraplatinum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awulyna.cn (fake_scanner)"; content:"|07|awulyna|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barmatuxa.info (zeus)"; content:"|09|barmatuxa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbortixx.info (luckysploit)"; content:"|08|bbortixx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scanpc.net (rogue)"; content:"|0b|best-scanpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biozavr.ru (malware)"; content:"|07|biozavr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biozov.ru (malware)"; content:"|06|biozov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bk-teknik.dk (rogue)"; content:"|09|bk-teknik|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup btctecnologia.com (trojan)"; content:"|0d|btctecnologia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bufertongamoda.com (braviax)"; content:"|0e|bufertongamoda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buteratorionasd.com (trojan)"; content:"|0f|buteratorionasd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccikudor.cn (exploits)"; content:"|08|ccikudor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celiminerkariota.com (trojan)"; content:"|10|celiminerkariota|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapsocks.cn (worm)"; content:"|0a|cheapsocks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check-threats-online.com (trojan)"; content:"|14|check-threats-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciscocommunity.cn (trojan)"; content:"|0e|ciscocommunity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citygateinc.com (trojan)"; content:"|0b|citygateinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnn08.com (malware)"; content:"|05|cnn08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coinheaven.com (rfi)"; content:"|0a|coinheaven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolvideo4dom.cn (zeus)"; content:"|0d|coolvideo4dom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter11.info (exploits)"; content:"|09|counter11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crkeys4cheap.com (malware)"; content:"|0c|crkeys4cheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybipmo.cn (malware)"; content:"|07|cybipmo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dark-cherep.com (malware)"; content:"|0b|dark-cherep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dem.real-host.org (zeus)"; content:"|03|dem|09|real-host|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup despnar.idsn.gov.co (rfi)"; content:"|07|despnar|04|idsn|03|gov|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diding.co.kr (exploits)"; content:"|06|diding|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directory.tatoosite.it (iframe)"; content:"|09|directory|09|tatoosite|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogstudio.net (rfi)"; content:"|09|dogstudio|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doinw.com (malware)"; content:"|05|doinw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-secure-files.com (trojan)"; content:"|15|download-secure-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doxws.com (malware)"; content:"|05|doxws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dumbmua.or.kr (iframe)"; content:"|07|dumbmua|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dz-evil.com (zeus)"; content:"|07|dz-evil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easynettest.com (malware)"; content:"|0b|easynettest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddxx.com (malware)"; content:"|05|eddxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ediyhy.cn (malware)"; content:"|06|ediyhy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elku.ru (exploits)"; content:"|04|elku|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elxolionave.com (braviax)"; content:"|0b|elxolionave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ericlapointe.com (phishing)"; content:"|0c|ericlapointe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertubredong.com (braviax)"; content:"|0b|ertubredong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exchangenew.com (malware)"; content:"|0b|exchangenew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fallsoftsafety.com (trojan)"; content:"|0e|fallsoftsafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scanandprotect.net (malware)"; content:"|13|fast-scanandprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchandprotect.com (malware)"; content:"|15|fast-searchandprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchandprotect.net (malware)"; content:"|15|fast-searchandprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchandsecure.com (malware)"; content:"|14|fast-searchandsecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchandsecure.net (malware)"; content:"|14|fast-searchandsecure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchprotection.com (rogue)"; content:"|15|fast-searchprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-searchprotection.net (rogue)"; content:"|15|fast-searchprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-systemguard.com (malware)"; content:"|10|fast-systemguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan-protect.com (malware)"; content:"|10|fastscan-protect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan-protect.net (malware)"; content:"|10|fastscan-protect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan-search.com (rogue)"; content:"|0f|fastscan-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan-search.net (rogue)"; content:"|0f|fastscan-search|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan-secure.com (rogue)"; content:"|0f|fastscan-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscanandprotect.com (malware)"; content:"|12|fastscanandprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscanandprotect.net (malware)"; content:"|12|fastscanandprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansecure.com (rogue)"; content:"|0e|fastscansecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansecure.net (malware)"; content:"|0e|fastscansecure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch-protection.com (rogue)"; content:"|15|fastsearch-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch-protection.net (rogue)"; content:"|15|fastsearch-protection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch-secure.com (malware)"; content:"|11|fastsearch-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch-secure.net (malware)"; content:"|11|fastsearch-secure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearchandprotect.com (malware)"; content:"|14|fastsearchandprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearchprotection.com (rogue)"; content:"|14|fastsearchprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearchprotection.net (rogue)"; content:"|14|fastsearchprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filemarket.net (exploits)"; content:"|0a|filemarket|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fit77.biz (exploits)"; content:"|05|fit77|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floattubesonline.com (fake_codec)"; content:"|10|floattubesonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flowersshoping.com (exploits)"; content:"|0e|flowersshoping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshhost.info (zeus)"; content:"|09|freshhost|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gevyta.cn (malware)"; content:"|06|gevyta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giandomenicolombardi.it (pdf_exploit)"; content:"|14|giandomenicolombardi|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogyadexchina0ab.cn (zeus)"; content:"|10|gogyadexchina0ab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenpost.co.kr (rfi)"; content:"|0a|goldenpost|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gratisweb.com (rfi)"; content:"|09|gratisweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumertagionader.com (trojan)"; content:"|0f|gumertagionader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup headlinenews2.com (rogue)"; content:"|0d|headlinenews2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herosima1yet.cn (zeus)"; content:"|0c|herosima1yet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idoafy.cn (rogue)"; content:"|06|idoafy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihrhrhrhereo.cn (exploits)"; content:"|0c|ihrhrhrhereo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgnode.cn (exploits)"; content:"|07|imgnode|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup informatica11.dominiotemporario.com (trojan)"; content:"|0d|informatica11|11|dominiotemporario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetprotectioncheck.com (malware)"; content:"|17|internetprotectioncheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipoxyid.cn (rogue)"; content:"|07|ipoxyid|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuulnta.cn (malware)"; content:"|07|iuulnta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuzhejw.cn (malware)"; content:"|07|iuzhejw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyvlayu.cn (malware)"; content:"|07|jyvlayu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup le-king-de-linformatique.com (harmful)"; content:"|18|le-king-de-linformatique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litjnz.cn (malware)"; content:"|06|litjnz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpreke.cn (malware)"; content:"|06|lpreke|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-reaper.com (rogue)"; content:"|0e|malware-reaper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-manager.info (harmful)"; content:"|0c|mega-manager|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-manager.net (harmful)"; content:"|0c|mega-manager|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-manager.org (harmful)"; content:"|0c|mega-manager|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-statistic.com (harmful)"; content:"|0e|mega-statistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirctr.org (harmful)"; content:"|06|mirctr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerscanner11.com (rogue)"; content:"|13|mycomputerscanner11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuherfodaverta.com (braviax)"; content:"|0e|nuherfodaverta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nulerotkabelast.com (trojan)"; content:"|0f|nulerotkabelast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuliborkawer.com (braviax)"; content:"|0c|nuliborkawer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nulkersonatior.com (braviax)"; content:"|0e|nulkersonatior|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omega5.cn (zeus)"; content:"|06|omega5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-cnn.com (malware)"; content:"|0a|online-cnn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open-dns.info (trojan)"; content:"|08|open-dns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opolertionfer.com (braviax)"; content:"|0d|opolertionfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oqaezfy.cn (malware)"; content:"|07|oqaezfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup org-edu.ru (zeus)"; content:"|07|org-edu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osujyre.cn (malware)"; content:"|07|osujyre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otherchina.cn (zeus)"; content:"|0a|otherchina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palata666.info (zeus)"; content:"|09|palata666|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup past-another-life.ru (exploits)"; content:"|11|past-another-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paulmccartneyusa.cn (exploits)"; content:"|10|paulmccartneyusa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plugidentity.com (zeus)"; content:"|0c|plugidentity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polanermogalios.com (braviax)"; content:"|0f|polanermogalios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polygraphy-p.ru (malware)"; content:"|0c|polygraphy-p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup professionalblackbook.com (iframe)"; content:"|15|professionalblackbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projekt2.de (rfi)"; content:"|08|projekt2|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-myzone.com (rogue)"; content:"|0e|protect-myzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-myzone.net (rogue)"; content:"|0e|protect-myzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protected-field.com (rogue)"; content:"|0f|protected-field|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmyzone.com (rogue)"; content:"|0d|protectmyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmyzone.net (rogue)"; content:"|0d|protectmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-now1.com (rogue)"; content:"|12|protectyourpc-now1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puritan-groupco.cc (fraud-scam)"; content:"|0f|puritan-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puritan-groupco.cn (fraud-scam)"; content:"|0f|puritan-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puritan-groupinc.cn (fraud-scam)"; content:"|10|puritan-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puritan-groupinc.com (fraud-scam)"; content:"|10|puritan-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regency-groupco.cn (fraud-scam)"; content:"|0f|regency-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regency-groupco.com (fraud-scam)"; content:"|0f|regency-groupco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regency-groupnet.cc (fraud-scam)"; content:"|10|regency-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regency-groupnet.cn (fraud-scam)"; content:"|10|regency-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup report-cnn.com (malware)"; content:"|0a|report-cnn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reycross.cn (malware)"; content:"|08|reycross|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roadone.net (rfi)"; content:"|07|roadone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rucoc.com (rfi)"; content:"|05|rucoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxumohas.cn (exploits)"; content:"|08|rxumohas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scambiovisite.tatoosite.it (iframe)"; content:"|0d|scambiovisite|09|tatoosite|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-4-clean.com (rogue)"; content:"|0c|scan-4-clean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdrukap.com (rogue)"; content:"|07|sdrukap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdefend.net (rogue)"; content:"|0c|searchdefend|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchscan-online.com (rogue)"; content:"|11|searchscan-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchscan-online.net (rogue)"; content:"|11|searchscan-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securescantools.com (malware)"; content:"|0f|securescantools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityrundlll.com (zeus)"; content:"|0f|securityrundlll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityscantooldirect.com (malware)"; content:"|16|securityscantooldirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytestnetonline.com (malware)"; content:"|15|securitytestnetonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup semihow.com (rfi)"; content:"|07|semihow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serversen.cn (zeus)"; content:"|09|serversen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skylife.cn (exploits)"; content:"|07|skylife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smsphonesymb02.cn (exploits)"; content:"|0e|smsphonesymb02|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socialbeautytips.com (iframe)"; content:"|10|socialbeautytips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softsafeness.com (rogue)"; content:"|0c|softsafeness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sowyen.co.kr (iframe)"; content:"|06|sowyen|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starcountry.ru (zeus)"; content:"|0b|starcountry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-track.com (harmful)"; content:"|0b|stats-track|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statscounter.cn (exploits)"; content:"|0c|statscounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stiggba.com (trojan)"; content:"|07|stiggba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susnoj.cn (malware)"; content:"|06|susnoj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suxumzulum.cn (botnet)"; content:"|0a|suxumzulum|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweetfay.cn (malware)"; content:"|08|sweetfay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemprotected.net (malware)"; content:"|0f|systemprotected|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tahribat.com (harmful)"; content:"|08|tahribat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tecbiosistemas.com.br (rfi)"; content:"|0e|tecbiosistemas|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-previous.ru (exploits)"; content:"|0c|the-previous|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theanotherlife.ru (exploits)"; content:"|0e|theanotherlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tilowgy.cn (fake_scanner)"; content:"|07|tilowgy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topspyfreecheck.com (fake_scanner)"; content:"|0f|topspyfreecheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tqeetazx.cn (malware)"; content:"|08|tqeetazx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tracker-stats.com (harmful)"; content:"|0d|tracker-stats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tracker-stats.net (harmful)"; content:"|0d|tracker-stats|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trust-systemguard.com (rogue)"; content:"|11|trust-systemguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustsystem-protect.net (malware)"; content:"|13|trustsystem-protect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustwarrior.com (rogue)"; content:"|0c|trustwarrior|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucuywih.cn (malware)"; content:"|07|ucuywih|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhajokalesko.com (braviax)"; content:"|0c|uhajokalesko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uk4you.cn (zeus)"; content:"|06|uk4you|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatedownloadcenter2.com (malware)"; content:"|15|updatedownloadcenter2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upiumry.cn (malware)"; content:"|07|upiumry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uplaserdunavats.com (trojan)"; content:"|0f|uplaserdunavats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaworkinghard.cn (rogue)"; content:"|0e|usaworkinghard|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uzehayb.cn (malware)"; content:"|07|uzehayb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoproducedsoftware.com (malware)"; content:"|15|videoproducedsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vision-groupinc.cn (fraud-scam)"; content:"|0f|vision-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vision-groupsvc.com (fraud-scam)"; content:"|0f|vision-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volkanboya.com (zeus)"; content:"|0a|volkanboya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vretupak.com (trojan)"; content:"|08|vretupak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuilertumegated.com (braviax)"; content:"|0f|vuilertumegated|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuilleskomandar.com (rogue)"; content:"|0f|vuilleskomandar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vulerdasonatka.com (braviax)"; content:"|0e|vulerdasonatka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watzthebuzz.com (malware)"; content:"|0b|watzthebuzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webinwild.co.uk (luckysploit)"; content:"|09|webinwild|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wett-profis.com (rfi)"; content:"|0b|wett-profis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weueai.cn (malware)"; content:"|06|weueai|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-up2date.cn (zeus)"; content:"|0f|windows-up2date|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowspcdefender.net (rogue)"; content:"|11|windowspcdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotection-suite.net (rogue)"; content:"|17|windowsprotection-suite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winfixscanner1.com (rogue)"; content:"|0e|winfixscanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winfixscanner2.com (rogue)"; content:"|0e|winfixscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winfixscanner7.com (rogue)"; content:"|0e|winfixscanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winfixscanner8.com (rogue)"; content:"|0e|winfixscanner8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winfixscanner9.com (rogue)"; content:"|0e|winfixscanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhtmlweb.com (rfi)"; content:"|08|xhtmlweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xouymiw.cn (malware)"; content:"|07|xouymiw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybcyyy.com (rfi)"; content:"|06|ybcyyy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yestour.net (rfi)"; content:"|07|yestour|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1weq.eu (fraud-scam)"; content:"|06|yh1weq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynoubfa.cn (rogue)"; content:"|07|ynoubfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynyxeg.cn (malware)"; content:"|06|ynyxeg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourfriskillness.cn (rogue)"; content:"|10|yourfriskillness|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecuritynetwork.com (malware)"; content:"|13|yoursecuritynetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zimzikjun.cn (rogue)"; content:"|09|zimzikjun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zpit.pl (trojan)"; content:"|04|zpit|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-online.hu (malware)"; content:"|08|t-online|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 753123.cn (zeus)"; content:"|06|753123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9049629062.com (zeus)"; content:"|0a|9049629062|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-ha-group.com (zeus)"; content:"|0a|a-ha-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaic.ru (zeus)"; content:"|04|aaic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaig.ru (zeus)"; content:"|04|aaig|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaiv.ru (zeus)"; content:"|04|aaiv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aclc.ru (zeus)"; content:"|04|aclc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancement-statekos.cn (zeus)"; content:"|14|advancement-statekos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alwaysky.cn (zeus)"; content:"|08|alwaysky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup american-avto.net (zeus)"; content:"|0d|american-avto|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanliit.cn (zeus)"; content:"|0c|americanliit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aol-update-installer.cn (zeus)"; content:"|14|aol-update-installer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup askthegoalkeeper.com (zeus)"; content:"|10|askthegoalkeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assdazzxcad.cn (zeus)"; content:"|0b|assdazzxcad|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avrev.info (zeus)"; content:"|05|avrev|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besher.net (zeus)"; content:"|06|besher|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bet7bet.cn (zeus)"; content:"|07|bet7bet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigamadillo.ru (zeus)"; content:"|0b|bigamadillo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigfreepussy.net (zeus)"; content:"|0c|bigfreepussy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blghacks.com (zeus)"; content:"|08|blghacks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup careyzfunz.com (zeus)"; content:"|0a|careyzfunz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cecilzfunz.com (zeus)"; content:"|0a|cecilzfunz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearrecords.ru (zeus)"; content:"|0c|clearrecords|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closerprups.com (zeus)"; content:"|0b|closerprups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comp-sp.ru (zeus)"; content:"|07|comp-sp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countrystar.ru (zeus)"; content:"|0b|countrystar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cz8.ru (zeus)"; content:"|03|cz8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deluz666.info (zeus)"; content:"|08|deluz666|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deropen.com (zeus)"; content:"|07|deropen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dibosh.cn (zeus)"; content:"|06|dibosh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirvsdl.co.kr (zeus)"; content:"|07|dirvsdl|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djhbzsv.cn (zeus)"; content:"|07|djhbzsv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docplus.ru (zeus)"; content:"|07|docplus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drbach.pl (zeus)"; content:"|06|drbach|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ef2tr.cn (zeus)"; content:"|05|ef2tr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eremenko.biz (zeus)"; content:"|08|eremenko|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esenins.cn (malware)"; content:"|07|esenins|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euroassistant.eu (zeus)"; content:"|0d|euroassistant|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairydata.cn (zeus)"; content:"|09|fairydata|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1aa.com (phishing)"; content:"|08|fedas1aa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ab.com (phishing)"; content:"|08|fedas1ab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ac.com (phishing)"; content:"|08|fedas1ac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ad.com (phishing)"; content:"|08|fedas1ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ae.com (phishing)"; content:"|08|fedas1ae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1af.com (phishing)"; content:"|08|fedas1af|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ag.com (phishing)"; content:"|08|fedas1ag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ah.com (phishing)"; content:"|08|fedas1ah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ai.com (phishing)"; content:"|08|fedas1ai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1aj.com (phishing)"; content:"|08|fedas1aj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ak.com (phishing)"; content:"|08|fedas1ak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1al.com (phishing)"; content:"|08|fedas1al|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1am.com (phishing)"; content:"|08|fedas1am|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1an.com (phishing)"; content:"|08|fedas1an|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ao.com (phishing)"; content:"|08|fedas1ao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ap.com (phishing)"; content:"|08|fedas1ap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1aq.com (phishing)"; content:"|08|fedas1aq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ar.com (phishing)"; content:"|08|fedas1ar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1as.com (phishing)"; content:"|08|fedas1as|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1at.com (phishing)"; content:"|08|fedas1at|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1au.com (phishing)"; content:"|08|fedas1au|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1av.com (phishing)"; content:"|08|fedas1av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1aw.com (phishing)"; content:"|08|fedas1aw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ax.com (phishing)"; content:"|08|fedas1ax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1ay.com (phishing)"; content:"|08|fedas1ay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedas1az.com (phishing)"; content:"|08|fedas1az|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghostusers.info (zeus)"; content:"|0a|ghostusers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldbrick.cn (zeus)"; content:"|09|goldbrick|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodsovclass.com (zeus)"; content:"|0c|goodsovclass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorodsnov.cn (malware)"; content:"|09|gorodsnov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groov.biz (zeus)"; content:"|05|groov|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groovemusics.net (zeus)"; content:"|0c|groovemusics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guild.hut.ru (zeus)"; content:"|05|guild|03|hut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harflash.cn (zeus)"; content:"|08|harflash|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellzoness.ru (zeus)"; content:"|0a|hellzoness|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homyak777.cn (zeus)"; content:"|09|homyak777|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostz-150909.com (zeus)"; content:"|0c|hostz-150909|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11ate.eu (phishing)"; content:"|06|i11ate|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11bte.eu (phishing)"; content:"|06|i11bte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11ete.eu (phishing)"; content:"|06|i11ete|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11hte.eu (phishing)"; content:"|06|i11hte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11ite.eu (phishing)"; content:"|06|i11ite|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11mte.eu (phishing)"; content:"|06|i11mte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11nte.eu (phishing)"; content:"|06|i11nte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11ote.eu (phishing)"; content:"|06|i11ote|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11pte.eu (phishing)"; content:"|06|i11pte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11rte.eu (phishing)"; content:"|06|i11rte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11tte.eu (phishing)"; content:"|06|i11tte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11ute.eu (phishing)"; content:"|06|i11ute|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11wte.eu (phishing)"; content:"|06|i11wte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11xte.eu (phishing)"; content:"|06|i11xte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i11zte.eu (phishing)"; content:"|06|i11zte|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ianndex.com (zeus)"; content:"|07|ianndex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inviagra.com (zeus)"; content:"|08|inviagra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacarise.it (zeus)"; content:"|08|jacarise|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaha1ws.eu (phishing)"; content:"|07|jaha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbha1ws.eu (phishing)"; content:"|07|jbha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdha1ws.eu (phishing)"; content:"|07|jdha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgha1ws.eu (phishing)"; content:"|07|jgha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjha1ws.eu (phishing)"; content:"|07|jjha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkha1ws.eu (phishing)"; content:"|07|jkha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmha1ws.eu (phishing)"; content:"|07|jmha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnha1ws.eu (phishing)"; content:"|07|jnha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpha1ws.eu (phishing)"; content:"|07|jpha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jqha1ws.eu (phishing)"; content:"|07|jqha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrha1ws.eu (phishing)"; content:"|07|jrha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jtha1ws.eu (phishing)"; content:"|07|jtha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juha1ws.eu (phishing)"; content:"|07|juha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1we.com (fraud)"; content:"|07|juhh1we|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wf.com (fraud)"; content:"|07|juhh1wf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wg.com (fraud)"; content:"|07|juhh1wg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wh.com (fraud)"; content:"|07|juhh1wh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wj.com (fraud)"; content:"|07|juhh1wj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wn.com (fraud)"; content:"|07|juhh1wn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wp.com (fraud)"; content:"|07|juhh1wp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wq.com (fraud)"; content:"|07|juhh1wq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wr.com (fraud)"; content:"|07|juhh1wr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juhh1wt.com (fraud)"; content:"|07|juhh1wt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvha1ws.eu (phishing)"; content:"|07|jvha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwha1ws.eu (phishing)"; content:"|07|jwha1ws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanabiolka.net (zeus)"; content:"|0a|kanabiolka|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanever.com (zeus)"; content:"|07|kanever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kid1hx.eu (zeus)"; content:"|06|kid1hx|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ks357429.kimsufi.com (zeus)"; content:"|08|ks357429|07|kimsufi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ledyzpizdik.cn (malware)"; content:"|0b|ledyzpizdik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limon4ik.cn (zeus)"; content:"|08|limon4ik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadir.net (zeus)"; content:"|06|loadir|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicpincer.com (zeus)"; content:"|0b|magicpincer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbtransfer.com (zeus)"; content:"|0a|mbtransfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megobill.cn (malware)"; content:"|08|megobill|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-honey-pet.in (zeus)"; content:"|0c|my-honey-pet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylfix4.cn (malware)"; content:"|07|mylfix4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naifos.biz (zeus)"; content:"|06|naifos|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerinsk.com (zeus)"; content:"|07|nerinsk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noabuseplease.cn (zeus)"; content:"|0d|noabuseplease|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonprobs.com (malware)"; content:"|08|nonprobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwac.ru (zeus)"; content:"|04|nwac|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onivgope.cn (zeus)"; content:"|08|onivgope|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onulor.cn (zeus)"; content:"|06|onulor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup option-1.org (zeus)"; content:"|08|option-1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otdel-k.cn (zeus)"; content:"|07|otdel-k|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p0rt3m.bplaced.net (zeus)"; content:"|06|p0rt3m|07|bplaced|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p0rt3m1337.bplaced.net (zeus)"; content:"|0a|p0rt3m1337|07|bplaced|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palmainfo.com (zeus)"; content:"|09|palmainfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pm13.ru (zeus)"; content:"|04|pm13|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pobedaim.cn (malware)"; content:"|08|pobedaim|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poolballset.com (zeus)"; content:"|0b|poolballset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup posledniy.cn (malware)"; content:"|09|posledniy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup predposledniy.cn (malware)"; content:"|0d|predposledniy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proxy5my.cn (malware)"; content:"|08|proxy5my|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvdiz.biz (zeus)"; content:"|05|pvdiz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvsex.biz (zeus)"; content:"|05|pvsex|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdr20090924.info (harmful)"; content:"|0b|rdr20090924|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richalina.cn (zeus)"; content:"|09|richalina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ripway.com (trojan)"; content:"|06|ripway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robotbobot.cn (zeus)"; content:"|0a|robotbobot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sattor.cn (zeus)"; content:"|06|sattor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmequick.com (zeus)"; content:"|0b|scanmequick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdf388fsh6767fsbb4ba7.com (zeus)"; content:"|15|sdf388fsh6767fsbb4ba7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seo-fraud.ru (zeus)"; content:"|09|seo-fraud|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sir-t.cn (zeus)"; content:"|05|sir-t|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sl111.net (zeus)"; content:"|05|sl111|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-phone-reviews.com (zeus)"; content:"|13|smart-phone-reviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softinfosite.com (zeus)"; content:"|0c|softinfosite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sscanner.ru (zeus)"; content:"|08|sscanner|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sureameritradex.com (zeus)"; content:"|0f|sureameritradex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technigoyous.net (zeus)"; content:"|0c|technigoyous|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theblogwebsite.com (zeus)"; content:"|0e|theblogwebsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timezero.freehostia.com (zeus)"; content:"|08|timezero|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tissot333.cn (zeus)"; content:"|09|tissot333|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic4stats.cn (zeus)"; content:"|0d|traffic4stats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uh1asu.eu (zeus)"; content:"|06|uh1asu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateload.info (zeus)"; content:"|0a|updateload|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateslive.net (zeus)"; content:"|0b|updateslive|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uscguard.com (zeus)"; content:"|08|uscguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v-bonus.ru (zeus)"; content:"|07|v-bonus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vadik.jino.ru (zeus)"; content:"|05|vadik|04|jino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vampizdecvsemnax.net (zeus)"; content:"|10|vampizdecvsemnax|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videowalha.co.uk (zeus)"; content:"|0a|videowalha|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viphack.ru (zeus)"; content:"|07|viphack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivabot.com (zeus)"; content:"|07|vivabot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vstdrrr.mn (zeus)"; content:"|07|vstdrrr|02|mn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vstdrrr.us (zeus)"; content:"|07|vstdrrr|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wapdodoit.ru (zeus)"; content:"|09|wapdodoit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wh0rse.net (zeus)"; content:"|06|wh0rse|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wipex.org (zeus)"; content:"|05|wipex|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woocasino.com (zeus)"; content:"|09|woocasino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldofshore.cn (zeus)"; content:"|0c|worldofshore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwooww.org (zeus)"; content:"|06|wwooww|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwaaa101.com (zeus)"; content:"|09|wwwaaa101|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwbypost.com (zeus)"; content:"|09|wwwbypost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwcfg.com (zeus)"; content:"|06|wwwcfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwipnot.com (zeus)"; content:"|08|wwwipnot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xepace.cn (zeus)"; content:"|06|xepace|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xoxo.slavhosthosting.ru (zeus)"; content:"|04|xoxo|0f|slavhosthosting|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dera.com (phishing)"; content:"|07|y11dera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derb.com (phishing)"; content:"|07|y11derb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derc.com (phishing)"; content:"|07|y11derc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derd.com (phishing)"; content:"|07|y11derd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dere.com (phishing)"; content:"|07|y11dere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derf.com (phishing)"; content:"|07|y11derf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derg.com (phishing)"; content:"|07|y11derg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derh.com (phishing)"; content:"|07|y11derh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11deri.com (phishing)"; content:"|07|y11deri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derj.com (phishing)"; content:"|07|y11derj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derk.com (phishing)"; content:"|07|y11derk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derl.com (phishing)"; content:"|07|y11derl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derm.com (phishing)"; content:"|07|y11derm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dern.com (phishing)"; content:"|07|y11dern|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dero.com (phishing)"; content:"|07|y11dero|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derp.com (phishing)"; content:"|07|y11derp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derq.com (phishing)"; content:"|07|y11derq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derr.com (phishing)"; content:"|07|y11derr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11ders.com (phishing)"; content:"|07|y11ders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dert.com (phishing)"; content:"|07|y11dert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11deru.com (phishing)"; content:"|07|y11deru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derv.com (phishing)"; content:"|07|y11derv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derw.com (phishing)"; content:"|07|y11derw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derx.com (phishing)"; content:"|07|y11derx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11dery.com (phishing)"; content:"|07|y11dery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y11derz.com (phishing)"; content:"|07|y11derz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ybsportcn.ws (zeus)"; content:"|09|ybsportcn|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yomobi.ru (zeus)"; content:"|06|yomobi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youloads.ru (zeus)"; content:"|08|youloads|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourhsc.jino.ru (zeus)"; content:"|07|yourhsc|04|jino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zother.net (zeus)"; content:"|06|zother|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krantik.info (zlob)"; content:"|07|krantik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveantivirusscanner.com (phishing)"; content:"|14|liveantivirusscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 03killspyware.com (rogue)"; content:"|0d|03killspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 09killspyware.com (rogue)"; content:"|0d|09killspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0lenfo.com (scareware)"; content:"|06|0lenfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12scanner.com (rogue)"; content:"|09|12scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 139shop.com (malware)"; content:"|07|139shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1limbo.net (scareware)"; content:"|06|1limbo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7killspyware.com (rogue)"; content:"|0c|7killspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 99081.com (malware)"; content:"|05|99081|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abclllab.com (scareware)"; content:"|08|abclllab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abeclick.biz (botnet)"; content:"|08|abeclick|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abenapi.cn (rogue)"; content:"|07|abenapi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abidar.cn (rogue)"; content:"|06|abidar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abiydu.cn (rogue)"; content:"|06|abiydu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abonyag.cn (rogue)"; content:"|07|abonyag|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acuavro.cn (rogue)"; content:"|07|acuavro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adaengu.cn (rogue)"; content:"|07|adaengu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adaryje.cn (rogue)"; content:"|07|adaryje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adelug.cn (rogue)"; content:"|06|adelug|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aditopia.com (botnet)"; content:"|08|aditopia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedvirus-remover2009.com (rogue)"; content:"|19|advancedvirus-remover2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedvirusscan.com (rogue)"; content:"|11|advancedvirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanedprovirusscan.com (rogue)"; content:"|13|advanedprovirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahoize.cn (rogue)"; content:"|06|ahoize|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajuyrme.cn (rogue)"; content:"|07|ajuyrme|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akapefi.cn (rogue)"; content:"|07|akapefi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anderspaludan.dk (abusive)"; content:"|0d|anderspaludan|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arbclicks.biz (botnet)"; content:"|09|arbclicks|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armysun3.com (harmful)"; content:"|08|armysun3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bencaputoprinting.com (harmful)"; content:"|11|bencaputoprinting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcheckonline.info (rogue)"; content:"|0f|bestcheckonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecurityinc.com (rogue)"; content:"|0f|bestsecurityinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombas10.com (scareware)"; content:"|08|bombas10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brigada-mx.com (rogue)"; content:"|0a|brigada-mx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkmy-pcnow.com (rogue)"; content:"|0d|checkmy-pcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cileky.cn (rogue)"; content:"|06|cileky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cisyto.cn (rogue)"; content:"|06|cisyto|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickzcompile.com (botnet)"; content:"|0d|clickzcompile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compurerthreats07.com (rogue)"; content:"|11|compurerthreats07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compurerthreats2.com (rogue)"; content:"|10|compurerthreats2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compurerthreats9.com (rogue)"; content:"|10|compurerthreats9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computeron-linescan03.com (rogue)"; content:"|15|computeron-linescan03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computeron-linescan04.com (rogue)"; content:"|15|computeron-linescan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computeron-linescan09.com (rogue)"; content:"|15|computeron-linescan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depuxod.cn (rogue)"; content:"|07|depuxod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domicud.cn (rogue)"; content:"|07|domicud|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr5.com (rogue)"; content:"|0c|downloadavr5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dunhah.cn (rogue)"; content:"|06|dunhah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eqaliho.cn (rogue)"; content:"|07|eqaliho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewodyha.cn (rogue)"; content:"|07|ewodyha|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup explorersecuritysuite.com (rogue)"; content:"|15|explorersecuritysuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch-protect.com (rogue)"; content:"|12|fastsearch-protect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearchprotect.net (rogue)"; content:"|11|fastsearchprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fezraqo.cn (rogue)"; content:"|07|fezraqo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgddx.com (malware)"; content:"|05|fgddx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glabmed.com (malspam)"; content:"|07|glabmed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalscanme.com (rogue)"; content:"|0c|globalscanme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalscanme.net (rogue)"; content:"|0c|globalscanme|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalzoneprotect.com (rogue)"; content:"|11|globalzoneprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalzoneprotect.net (rogue)"; content:"|11|globalzoneprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalzoneprotected.com (rogue)"; content:"|13|globalzoneprotected|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalzonescan.net (rogue)"; content:"|0e|globalzonescan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graves111.com (scareware)"; content:"|09|graves111|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helpyourpcsecuritynow.com (rogue)"; content:"|15|helpyourpcsecuritynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hucdase.cn (rogue)"; content:"|07|hucdase|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idisuan.cn (rogue)"; content:"|07|idisuan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idowear.cn (rogue)"; content:"|07|idowear|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagination-1.com (scareware)"; content:"|0d|imagination-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immitations-all.net (scareware)"; content:"|0f|immitations-all|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivirus-scan.com (rogue)"; content:"|17|internet-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetantivirusproscan.com (rogue)"; content:"|18|internetantivirusproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetantivirusproscanner.com (rogue)"; content:"|1b|internetantivirusproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetsecurityscan.com (rogue)"; content:"|14|internetsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iriskas.com (scareware)"; content:"|07|iriskas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kayadizel.com (harmful)"; content:"|09|kayadizel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzzon837.cn (trojan)"; content:"|09|muzzon837|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-newprotection.net (rogue)"; content:"|10|my-newprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompinfo17.com (rogue)"; content:"|0c|mycompinfo17|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompinfo23.com (rogue)"; content:"|0c|mycompinfo23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompinfo3.com (rogue)"; content:"|0b|mycompinfo3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompscanner.com (rogue)"; content:"|0d|mycompscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompscanner02.com (rogue)"; content:"|0f|mycompscanner02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompscanner07.com (rogue)"; content:"|0f|mycompscanner07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompscanner22.com (rogue)"; content:"|0f|mycompscanner22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputer-scanner11.com (rogue)"; content:"|14|mycomputer-scanner11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputer-scanner1a.com (rogue)"; content:"|14|mycomputer-scanner1a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputer-scannera.com (rogue)"; content:"|13|mycomputer-scannera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputer-scannerp.com (rogue)"; content:"|13|mycomputer-scannerp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerlivescan2.com (rogue)"; content:"|13|mycomputerlivescan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronline03.com (rogue)"; content:"|12|mycomputeronline03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronline04.com (rogue)"; content:"|12|mycomputeronline04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronline06.com (rogue)"; content:"|12|mycomputeronline06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronline07.com (rogue)"; content:"|12|mycomputeronline07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronlinescan04.com (rogue)"; content:"|16|mycomputeronlinescan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronlinescan08.com (rogue)"; content:"|16|mycomputeronlinescan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronlinescan09.com (rogue)"; content:"|16|mycomputeronlinescan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputeronlinescan11.com (rogue)"; content:"|16|mycomputeronlinescan11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerproscan11.com (rogue)"; content:"|13|mycomputerproscan11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerscan14.com (rogue)"; content:"|10|mycomputerscan14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerscanner15.com (rogue)"; content:"|13|mycomputerscanner15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputersecurescan2.com (rogue)"; content:"|15|mycomputersecurescan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputersvirscan2.com (rogue)"; content:"|13|mycomputersvirscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerthreats03.com (rogue)"; content:"|13|mycomputerthreats03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerthreats11.com (rogue)"; content:"|13|mycomputerthreats11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerthreats15.com (rogue)"; content:"|13|mycomputerthreats15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputertotalscan2.com (rogue)"; content:"|14|mycomputertotalscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerupdates01.com (rogue)"; content:"|13|mycomputerupdates01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerupdates06.com (rogue)"; content:"|13|mycomputerupdates06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerwinscan2.com (rogue)"; content:"|12|mycomputerwinscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystem-protection.com (rogue)"; content:"|13|mysystem-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytotalscanner.com (rogue)"; content:"|0e|mytotalscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myvirusscanner2.com (rogue)"; content:"|0f|myvirusscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzoneguard.com (rogue)"; content:"|0b|myzoneguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzoneguard.net (rogue)"; content:"|0b|myzoneguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzonesecure.com (rogue)"; content:"|0c|myzonesecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzonesecure.net (rogue)"; content:"|0c|myzonesecure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nepsoym.cn (rogue)"; content:"|07|nepsoym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmedtest.com (rogue)"; content:"|0a|netmedtest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogywuep.cn (rogue)"; content:"|07|ogywuep|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olyety.cn (rogue)"; content:"|06|olyety|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omegaantivir.com (rogue)"; content:"|0c|omegaantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemalwareserch.cn (rogue)"; content:"|12|onlinemalwareserch|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesafesoftware.com (rogue)"; content:"|12|onlinesafesoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opyhila.cn (rogue)"; content:"|07|opyhila|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otobym.cn (rogue)"; content:"|06|otobym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pctrouble-remover.com (rogue)"; content:"|11|pctrouble-remover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectinstructor.cn (scareware)"; content:"|11|protectinstructor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pywudar.cn (rogue)"; content:"|07|pywudar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyzuhme.cn (rogue)"; content:"|07|pyzuhme|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qepmof.cn (rogue)"; content:"|06|qepmof|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rampir.info (rogue)"; content:"|06|rampir|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riwryse.cn (rogue)"; content:"|07|riwryse|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonlinesite.com (rogue)"; content:"|0e|scanonlinesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-systemprotect.com (rogue)"; content:"|14|search-systemprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-systemprotect.net (rogue)"; content:"|14|search-systemprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedwebsafesurf.com (rogue)"; content:"|12|securedwebsafesurf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securemyzone.com (rogue)"; content:"|0c|securemyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securemyzone.net (rogue)"; content:"|0c|securemyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureveteran.com (rogue)"; content:"|0d|secureveteran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securewinupdatesv3.com (rogue)"; content:"|12|securewinupdatesv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitybugfixupdate6.com (rogue)"; content:"|15|securitybugfixupdate6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycodereviews.com (rogue)"; content:"|13|securitycodereviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityland.cn (scareware)"; content:"|0c|securityland|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysupplycenter.com (rogue)"; content:"|14|securitysupplycenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spamit.com (malspam)"; content:"|06|spamit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-test.net (rogue)"; content:"|0c|spyware-test|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareshop.info (attack_site)"; content:"|0b|spywareshop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stabilityscantool.com (rogue)"; content:"|11|stabilityscantool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uatoolbar.com (botnet)"; content:"|09|uatoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unsecurewebsiteblock.com (rogue)"; content:"|14|unsecurewebsiteblock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatesystem01.com (rogue)"; content:"|0e|updatesystem01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatesystem02.com (rogue)"; content:"|0e|updatesystem02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upuoro.cn (rogue)"; content:"|06|upuoro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uqapyij.cn (rogue)"; content:"|07|uqapyij|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoplugindirect.net (malware)"; content:"|11|videoplugindirect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videopluginload.com (trojan)"; content:"|0f|videopluginload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videostudiodirect.com (malware)"; content:"|11|videostudiodirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videotubeplanete.com (fake_codec)"; content:"|10|videotubeplanete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wecafko.cn (rogue)"; content:"|07|wecafko|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdefenderupdate5.com (rogue)"; content:"|16|windowsdefenderupdate5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsguard-pro.com (rogue)"; content:"|10|windowsguard-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotectionupdate4.com (rogue)"; content:"|18|windowsprotectionupdate4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsecurityupdatesv2.com (rogue)"; content:"|14|winsecurityupdatesv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winshield2009.com (rogue)"; content:"|0d|winshield2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wobcyn.cn (rogue)"; content:"|06|wobcyn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyxiva.cn (rogue)"; content:"|06|xyxiva|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydihuq.cn (rogue)"; content:"|06|ydihuq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygyiqu.cn (rogue)"; content:"|06|ygyiqu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yjiakyn.cn (rogue)"; content:"|07|yjiakyn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymocuw.cn (rogue)"; content:"|06|ymocuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvicawo.cn (scareware)"; content:"|07|yvicawo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zydfaqe.cn (rogue)"; content:"|07|zydfaqe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 02fgu145501.cn (threat)"; content:"|0b|02fgu145501|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0day33hours.com (rogue)"; content:"|0b|0day33hours|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 13spl.com (exploit)"; content:"|05|13spl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1699online.net (luckysploit)"; content:"|0a|1699online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1mytotalscan.com (harmful)"; content:"|0c|1mytotalscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1year2months.com (rogue)"; content:"|0c|1year2months|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2029online.net (luckysploit)"; content:"|0a|2029online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 666x666.echo-host.com (exploits)"; content:"|07|666x666|09|echo-host|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7msdavtraff.com (exploit)"; content:"|0b|7msdavtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 933311.by.ru (rfi)"; content:"|06|933311|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-scanner.com (fake_av)"; content:"|09|a-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aahsdvsynrrmwnbmpklb.cn (harmful)"; content:"|14|aahsdvsynrrmwnbmpklb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdulahuy.com (trojan)"; content:"|09|abdulahuy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abumasotkamid.com (braviax)"; content:"|0d|abumasotkamid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acawyr.cn (fake_av)"; content:"|06|acawyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agonlinepro.com (malware)"; content:"|0b|agonlinepro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alienmovie.cn (fake_av)"; content:"|0a|alienmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-about-steve.cn (fake_av)"; content:"|0f|all-about-steve|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfilesstorage.com (trojan)"; content:"|0f|allfilesstorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfilesstoragecenter.com (trojan)"; content:"|15|allfilesstoragecenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allsonglife.com (malware)"; content:"|0b|allsonglife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alltime4you.org (malware)"; content:"|0b|alltime4you|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amateursex-heart.com (iframe)"; content:"|10|amateursex-heart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anjacam.com (iframe)"; content:"|07|anjacam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaretotalscan8.com (harmful)"; content:"|15|antispywaretotalscan8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaretotalscan9.com (harmful)"; content:"|15|antispywaretotalscan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusfreec0.cn (exploit)"; content:"|0f|antivirusfreec0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artick.wen.ru (rfi)"; content:"|06|artick|03|wen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asso-erasmus.com (rfi)"; content:"|0c|asso-erasmus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astro-boy.cn (fake_av)"; content:"|09|astro-boy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcheker123.com (exploit)"; content:"|0b|avcheker123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baconguide.cn (rogue)"; content:"|0a|baconguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barraccuda.cn (zeus)"; content:"|0a|barraccuda|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup battle-for-europe.com (rogue)"; content:"|11|battle-for-europe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedioger.com (exploits)"; content:"|08|bedioger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besenok.org (trojan)"; content:"|07|besenok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezopbiz.ru (emo_loader)"; content:"|08|bezopbiz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgaforyou.net (malware)"; content:"|09|bgaforyou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill-bailey.cn (fake_av)"; content:"|0b|bill-bailey|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biznessnews.cn (zeus)"; content:"|0b|biznessnews|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl4ck0ut.com (trojan)"; content:"|08|bl4ck0ut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl4ckb0y.com (trojan)"; content:"|08|bl4ckb0y|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackwater-ironworks.com (iframe)"; content:"|14|blackwater-ironworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bliyonoc.cn (exploit)"; content:"|08|bliyonoc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blocketpc.com (rogue)"; content:"|09|blocketpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blooddiamond.cn (fake_av)"; content:"|0c|blooddiamond|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bomkafeguilert.com (braviax)"; content:"|0e|bomkafeguilert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bot77.biz (trojandropper)"; content:"|05|bot77|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boy-meets-world.com (fake_av)"; content:"|0f|boy-meets-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bterkulas.com (fake_scanner)"; content:"|09|bterkulas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buenoos.cn (rogue_codec)"; content:"|07|buenoos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulerkosedasko.com (braviax)"; content:"|0e|bulerkosedasko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabisbeer.com (iframe)"; content:"|0c|cannabisbeer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabislyric.com (iframe)"; content:"|0d|cannabislyric|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabispicture.com (iframe)"; content:"|0f|cannabispicture|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabisrecipe.com (iframe)"; content:"|0e|cannabisrecipe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabisvaporizer.com (iframe)"; content:"|11|cannabisvaporizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cannabisvodka.com (iframe)"; content:"|0d|cannabisvodka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup captchastop.com (malware)"; content:"|0b|captchastop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capthcabreak.com (malware)"; content:"|0c|capthcabreak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbt4real.com (iframe)"; content:"|08|cbt4real|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccs.kaist.ac.kr (rfi)"; content:"|03|ccs|05|kaist|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup china-top.ru (rfi)"; content:"|09|china-top|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compurerthreats4.com (rogue)"; content:"|10|compurerthreats4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-scanner02.com (harmful)"; content:"|12|computer-scanner02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-scanner12.com (rogue)"; content:"|12|computer-scanner12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computervirusscanner31.com (harmful)"; content:"|16|computervirusscanner31|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectapac.net (rfi)"; content:"|0b|connectapac|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cookingwithmarijuana.com (iframe)"; content:"|14|cookingwithmarijuana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolbesttubes.com (trojan)"; content:"|0d|coolbesttubes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coommfoorum.com (trojan)"; content:"|0b|coommfoorum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2758.mnogoijirno.com (rogue)"; content:"|08|core2758|0b|mnogoijirno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cradleoffilthfan.com (rogue)"; content:"|10|cradleoffilthfan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datafolders.ru (exploit)"; content:"|0b|datafolders|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dia2.cn (emo_loader)"; content:"|04|dia2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diakonia-jkt.sch.id (rfi)"; content:"|0c|diakonia-jkt|03|sch|02|id"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discovirtual.graftempo.com.br (trojan)"; content:"|0c|discovirtual|09|graftempo|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolce-unt-gabbana.com (fake_av)"; content:"|11|dolce-unt-gabbana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotrpet.com (fast_flux)"; content:"|07|dotrpet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup effects-of-marijuana.com (iframe)"; content:"|14|effects-of-marijuana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup embrari-2.cn (exploit)"; content:"|09|embrari-2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erotic-baby-girl.com (trojan)"; content:"|10|erotic-baby-girl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertanuskayert.com (trojan)"; content:"|0d|ertanuskayert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup et7lktf.cn (exploits)"; content:"|07|et7lktf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup express.greencustomersupport.com (rogue)"; content:"|07|express|14|greencustomersupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fat77.biz (exploit)"; content:"|05|fat77|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fpappalardo.com (rfi)"; content:"|0b|fpappalardo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freetvnews2.com (fake_av)"; content:"|0b|freetvnews2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-house-stuff.cn (rogue)"; content:"|10|full-house-stuff|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funabho.cn (fake_scanner)"; content:"|07|funabho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamezprumz.com (malware)"; content:"|0a|gamezprumz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasmaskbong.com (iframe)"; content:"|0b|gasmaskbong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getallstats.com (fake_av)"; content:"|0b|getallstats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmall.co.kr (rfi)"; content:"|07|getmall|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getwin.biz (harmful)"; content:"|06|getwin|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogogogogogogogogogogo.cn (exploits)"; content:"|16|gogogogogogogogogogogo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldstats1.net (fake_av)"; content:"|0a|goldstats1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomutescan.com (fake_av)"; content:"|0a|gomutescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goneatscan.com (fake_av)"; content:"|0a|goneatscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good516.com (trojan)"; content:"|07|good516|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googapa.net (rogue)"; content:"|07|googapa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.maniyakat.cn (exploit)"; content:"|06|google|09|maniyakat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup growingmarijuanaindoors.com (iframe)"; content:"|17|growingmarijuanaindoors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup growingmarijuanaoutdoors.com (iframe)"; content:"|18|growingmarijuanaoutdoors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hanyeong.ac.kr (rfi)"; content:"|08|hanyeong|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haphoptool.ru (exploit)"; content:"|0a|haphoptool|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hashmaking.com (iframe)"; content:"|0a|hashmaking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellogoodby.cn (fake_av)"; content:"|0b|hellogoodby|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herosima1yet00g.cn (exploit)"; content:"|0f|herosima1yet00g|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoho-2.cn (trojan)"; content:"|06|hoho-2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homemadebong.com (iframe)"; content:"|0c|homemadebong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmediaplugin.com (trojan)"; content:"|0e|hotmediaplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmusicgroup.com (iframe)"; content:"|0d|hotmusicgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hr-mag.com (rfi)"; content:"|06|hr-mag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htm5.co.cc (trojan)"; content:"|04|htm5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulmeux.com (exploits)"; content:"|07|hulmeux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idfllrp.co.uk (fast_flux)"; content:"|07|idfllrp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inbizness.cn (exploit)"; content:"|09|inbizness|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infolator.info (rogue)"; content:"|09|infolator|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infosrep.cn (zeus)"; content:"|08|infosrep|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inglouriousbasterds.cn (fake_av)"; content:"|13|inglouriousbasterds|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inpanel.cn (exploit)"; content:"|07|inpanel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooiiooi.cn (zeus)"; content:"|08|iooiiooi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iphone.pornopur.com (iframe)"; content:"|06|iphone|08|pornopur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ispiritatus.cn (trojan)"; content:"|0b|ispiritatus|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itauempresa.mobi (zeus)"; content:"|0b|itauempresa|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwiekza.cn (fake_scanner)"; content:"|07|iwiekza|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup james-taylor.cn (fake_av)"; content:"|0c|james-taylor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jennifer-hudson-site.com (fake_av)"; content:"|14|jennifer-hudson-site|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeremy-kyle-now.cn (fake_av)"; content:"|0f|jeremy-kyle-now|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkgarments.com (iframe)"; content:"|0a|jkgarments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup join2758.takemypaymentsx.com (fraudulent)"; content:"|08|join2758|0f|takemypaymentsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanibali.info (exploit)"; content:"|08|kanibali|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaspersky.ee (rfi)"; content:"|09|kaspersky|02|ee"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keule557.cn (malicious)"; content:"|08|keule557|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khmerdailynews.net (rfi)"; content:"|0e|khmerdailynews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koreadefence.net (rfi)"; content:"|0c|koreadefence|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kpizuyuw.cn (exploit)"; content:"|08|kpizuyuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kzayopoq.cn (exploit)"; content:"|08|kzayopoq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lab-sport.cn (zeus)"; content:"|09|lab-sport|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lalalaaa.cn (exploits)"; content:"|08|lalalaaa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landingerfor.org (luckysploit)"; content:"|0c|landingerfor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legalizationofmarijuana.com (iframe)"; content:"|17|legalizationofmarijuana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linoge.biz (exploits)"; content:"|06|linoge|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lioleng.org (trojan)"; content:"|07|lioleng|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liposdakoferda.com (braviax)"; content:"|0e|liposdakoferda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lusia777.com (luckysploit)"; content:"|08|lusia777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m4n3x7d4y.cn (trojan)"; content:"|09|m4n3x7d4y|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m77s.cn (exploits)"; content:"|04|m77s|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malicioussiteblock.com (malware)"; content:"|12|malicioussiteblock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuana-tea.com (iframe)"; content:"|0d|marijuana-tea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanaart.com (iframe)"; content:"|0c|marijuanaart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanarecipe.com (iframe)"; content:"|0f|marijuanarecipe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanascreensavers.com (iframe)"; content:"|15|marijuanascreensavers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanause.com (iframe)"; content:"|0c|marijuanause|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanavaporizer.com (iframe)"; content:"|12|marijuanavaporizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanavaporizers.com (iframe)"; content:"|13|marijuanavaporizers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marijuanawallpaper.com (iframe)"; content:"|12|marijuanawallpaper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marty.id-sign.com (fake_av)"; content:"|05|marty|07|id-sign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcount.net (exploit)"; content:"|06|mcount|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdflrpp.com (fast_flux)"; content:"|07|mdflrpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meankirdo.info (exploit)"; content:"|09|meankirdo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalmarijuanablog.com (iframe)"; content:"|14|medicalmarijuanablog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melhordia.info (rfi)"; content:"|09|melhordia|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11f1.eu (zeus)"; content:"|06|mi11f1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fa.eu (zeus)"; content:"|06|mi11fa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fd.eu (zeus)"; content:"|06|mi11fd|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fe.eu (zeus)"; content:"|06|mi11fe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11ff.eu (zeus)"; content:"|06|mi11ff|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fi.eu (zeus)"; content:"|06|mi11fi|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fp.eu (zeus)"; content:"|06|mi11fp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fq.eu (zeus)"; content:"|06|mi11fq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fr.eu (zeus)"; content:"|06|mi11fr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fs.eu (zeus)"; content:"|06|mi11fs|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11ft.eu (zeus)"; content:"|06|mi11ft|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fu.eu (zeus)"; content:"|06|mi11fu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mi11fy.eu (zeus)"; content:"|06|mi11fy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftprogram.cn (exploit)"; content:"|10|microsoftprogram|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miestozinios.lt (rfi)"; content:"|0c|miestozinios|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mijui1b.com (fast_flux)"; content:"|07|mijui1b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitroger.cn (zeus)"; content:"|08|mitroger|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miyamibiach.ru (trojan)"; content:"|0b|miyamibiach|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrpros1.com (fast_flux)"; content:"|08|msrpros1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muchtubebetter.com (trojan)"; content:"|0e|muchtubebetter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mulicon.cn (zeus)"; content:"|07|mulicon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murianin.com (exploits)"; content:"|08|murianin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantispywarecheck17.com (rogue)"; content:"|14|myantispywarecheck17|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycompscanner42.com (harmful)"; content:"|0f|mycompscanner42|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputertotalscann11.com (harmful)"; content:"|16|mycomputertotalscann11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfoundryart.com (malware)"; content:"|0c|myfoundryart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymobilas.net (fake_av)"; content:"|09|mymobilas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynes-consult.cn (fraud)"; content:"|0d|mynes-consult|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytotalscan11.com (rogue)"; content:"|0d|mytotalscan11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neasqw21s.com (fast_flux)"; content:"|09|neasqw21s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neasqw21y.com (fast_flux)"; content:"|09|neasqw21y|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtvset.com (trojan)"; content:"|08|newtvset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicenewtube.com (trojan)"; content:"|0b|nicenewtube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlequcic.cn (exploit)"; content:"|08|nlequcic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nm11df.cn (malware)"; content:"|06|nm11df|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt002.cn (malware)"; content:"|05|nt002|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nurefadertogafe.com (braviax)"; content:"|0f|nurefadertogafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omg.od.ua (exploit)"; content:"|03|omg|02|od|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paferbasedos.com (braviax)"; content:"|0c|paferbasedos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradise-lost-island.com (fraudulent)"; content:"|14|paradise-lost-island|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pay-day.cn (malware)"; content:"|07|pay-day|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanner16.com (rogue)"; content:"|0c|pc-scanner16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcthreatremover.com (fake_codec)"; content:"|0f|pcthreatremover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipetro.org (luckysploit)"; content:"|07|pipetro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poohfamily.client.jp (iframe)"; content:"|0a|poohfamily|06|client|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porno-movies.biz (exploit)"; content:"|0c|porno-movies|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablevaporizer.com (iframe)"; content:"|11|portablevaporizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup potvaporizer.com (iframe)"; content:"|0c|potvaporizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup presidencia.gob.pa (zeus)"; content:"|0b|presidencia|03|gob|02|pa"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privet1.cn (trojan)"; content:"|07|privet1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privet2.cn (trojan)"; content:"|07|privet2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privet3.cn (exploit)"; content:"|07|privet3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proftpss.com (fast_flux)"; content:"|08|proftpss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prostrpp.com (fast_flux)"; content:"|08|prostrpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purethc.com (iframe)"; content:"|07|purethc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ravelotti.cn (exploit)"; content:"|09|ravelotti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup read-cnn2.com (fake_av)"; content:"|09|read-cnn2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relevant-information.cn (exploit)"; content:"|14|relevant-information|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronnytail.cn (trojan)"; content:"|09|ronnytail|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roorbong.com (iframe)"; content:"|08|roorbong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rootzundrground.cn (malware)"; content:"|0f|rootzundrground|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roxpriv8.xpg.com.br (rfi)"; content:"|08|roxpriv8|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rss-lenta-news.ru (zeus)"; content:"|0e|rss-lenta-news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russiancharityfund.com (trojan)"; content:"|12|russiancharityfund|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safewindowsupdate.com (malware)"; content:"|11|safewindowsupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samhwaeng.com (rfi)"; content:"|09|samhwaeng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmypc-online.net (rogue)"; content:"|0f|scanmypc-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scukonherproger.com (braviax)"; content:"|0f|scukonherproger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seo-on.com (trojan)"; content:"|06|seo-on|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seorakhoney.com (rfi)"; content:"|0b|seorakhoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexgirlsteen.com (fake_av)"; content:"|0c|sexgirlsteen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexygallets.com (exploit)"; content:"|0b|sexygallets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sh1908.org (rfi)"; content:"|06|sh1908|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheralbu.com (exploits)"; content:"|08|sheralbu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showmethesecret.cn (rogue)"; content:"|0f|showmethesecret|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjobergsbygg.nu (rfi)"; content:"|0c|sjobergsbygg|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ski.spb.ru (rfi)"; content:"|03|ski|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosiska.cn (zeus)"; content:"|07|sosiska|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sports.wisegiga.net (rfi)"; content:"|06|sports|08|wisegiga|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaresite.info (rogue)"; content:"|0b|spywaresite|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stabilytukbab.com (malware)"; content:"|0d|stabilytukbab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-1.cn (exploit)"; content:"|0b|stallvars-1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-2.cn (exploit)"; content:"|0b|stallvars-2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statickingdom.com (malware)"; content:"|0d|statickingdom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-malware.info (harmful)"; content:"|0c|stop-malware|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumyho.cn (trojan)"; content:"|06|sumyho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syandexx.ru (backdoor)"; content:"|08|syandexx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syndiconomie.fr (rfi)"; content:"|0c|syndiconomie|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tertunavogav.com (braviax)"; content:"|0c|tertunavogav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thcextractor.com (iframe)"; content:"|0c|thcextractor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thcvaporizer.com (iframe)"; content:"|0c|thcvaporizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-evil-empire.net (iframe)"; content:"|0f|the-evil-empire|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefinaldestination.cn (fake_av)"; content:"|13|thefinaldestination|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tohva.org (koobface)"; content:"|05|tohva|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tooratios.com (trojan)"; content:"|09|tooratios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalcomputerscan12.com (harmful)"; content:"|13|totalcomputerscan12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup town-classifieds.com (rfi)"; content:"|10|town-classifieds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traff2go.com (fake_av)"; content:"|08|traff2go|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffcount.cn (exploit)"; content:"|0a|traffcount|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficgrowth.com (iframe)"; content:"|0d|trafficgrowth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trombocit.com (exploit)"; content:"|09|trombocit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typeofmarijuana.com (iframe)"; content:"|0f|typeofmarijuana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyrdssl.com (fast_flux)"; content:"|07|tyrdssl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyscieq.cn (fake_scanner)"; content:"|07|tyscieq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uksprite.com (iframe)"; content:"|08|uksprite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ulioperdanogad.com (braviax)"; content:"|0e|ulioperdanogad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup universoulbeats.com (rfi)"; content:"|0f|universoulbeats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup up002.cn (harmful)"; content:"|05|up002|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vciqupoj.cn (exploit)"; content:"|08|vciqupoj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vetcuof.cn (rogue)"; content:"|07|vetcuof|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viaclan.org (rfi)"; content:"|07|viaclan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipeks.cn (zeus)"; content:"|06|vipeks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusprotectiontool.com (fake_scanner)"; content:"|13|virusprotectiontool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmk.org.ua (harmful)"; content:"|03|vmk|03|org|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vudermaguliermot.com (braviax)"; content:"|10|vudermaguliermot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuretronulevka.com (braviax)"; content:"|0e|vuretronulevka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wallgates.info (malware)"; content:"|09|wallgates|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wc-zone2.biz (trojan)"; content:"|08|wc-zone2|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-montagne.com (rfi)"; content:"|0c|web-montagne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-paradise.cn (rogue)"; content:"|0c|web-paradise|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-protection9.com (harmful)"; content:"|0f|win-protection9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotection-8.com (harmful)"; content:"|13|windowsprotection-8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winnetworkstatus.com (malware)"; content:"|10|winnetworkstatus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwonlinescanner.com (harmful)"; content:"|10|wwwonlinescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-on.tk (rfi)"; content:"|04|x-on|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xenotraf1.info (rogue)"; content:"|09|xenotraf1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygfc1.cn (exploits)"; content:"|05|ygfc1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1a.eu (zeus)"; content:"|06|yoky1a|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1c.eu (zeus)"; content:"|06|yoky1c|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1d.eu (zeus)"; content:"|06|yoky1d|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1e.eu (zeus)"; content:"|06|yoky1e|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1f.eu (zeus)"; content:"|06|yoky1f|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1g.eu (zeus)"; content:"|06|yoky1g|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1n.eu (zeus)"; content:"|06|yoky1n|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1r.eu (zeus)"; content:"|06|yoky1r|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1t.eu (zeus)"; content:"|06|yoky1t|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1v.eu (zeus)"; content:"|06|yoky1v|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1w.eu (zeus)"; content:"|06|yoky1w|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1x.eu (zeus)"; content:"|06|yoky1x|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1y.eu (zeus)"; content:"|06|yoky1y|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoky1z.eu (zeus)"; content:"|06|yoky1z|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yournewvideo.info (trojan)"; content:"|0c|yournewvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zfrexendzorex.cn (exploit)"; content:"|0d|zfrexendzorex|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zipclube.com (rfi)"; content:"|08|zipclube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsjs.nmfc.gov.cn (rfi)"; content:"|04|zsjs|04|nmfc|03|gov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1165651291.com (rogue)"; content:"|0a|1165651291|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3s8v.cn (malware)"; content:"|04|3s8v|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5mariasara.cn (rogue)"; content:"|0a|5mariasara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6mariasara.cn (rogue)"; content:"|0a|6mariasara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77host.cn (zeus)"; content:"|06|77host|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7mariasara.cn (rogue)"; content:"|0a|7mariasara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8mariasara.cn (rogue)"; content:"|0a|8mariasara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9mariasara.cn (rogue)"; content:"|0a|9mariasara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adbnr.ru (sql_injection)"; content:"|05|adbnr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afyjeq.cn (trojan)"; content:"|06|afyjeq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agribasal-me.com (trojan)"; content:"|0c|agribasal-me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alalask1.cn (rogue)"; content:"|08|alalask1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alalask2.cn (rogue)"; content:"|08|alalask2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alalask3.cn (rogue)"; content:"|08|alalask3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alarmtube.freehostia.com (trojan)"; content:"|09|alarmtube|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allwebpublic.cn (trojan)"; content:"|0c|allwebpublic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-freescan.com (rogue)"; content:"|10|antivir-freescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup authserver.ws (zeus)"; content:"|0a|authserver|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ava-group.cc (fraud)"; content:"|09|ava-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ava-group.cn (fraud)"; content:"|09|ava-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ava-groupsvc.cc (fraud)"; content:"|0c|ava-groupsvc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avagroupsvc.cn (fraud)"; content:"|0b|avagroupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banubanasy.cn (malware)"; content:"|0a|banubanasy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benharpergals.com (rogue)"; content:"|0d|benharpergals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizadmin.hongik.ac.kr (rfi)"; content:"|08|bizadmin|06|hongik|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizorderpage.cn (malware)"; content:"|0c|bizorderpage|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup black-engine.cn (trojan)"; content:"|0c|black-engine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bloch-data.dk (scareware)"; content:"|0a|bloch-data|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup block-spyware.co.cc (trojan)"; content:"|0d|block-spyware|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blocksporom.tripod.com (zeus)"; content:"|0b|blocksporom|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bokongerslev.dk (scareware)"; content:"|0c|bokongerslev|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brukamus.com (trojan)"; content:"|08|brukamus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camaravc.com.br (rfi)"; content:"|08|camaravc|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catcherin-the-rye.com (rogue_antivirus)"; content:"|11|catcherin-the-rye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clara5elena.cn (rogue)"; content:"|0b|clara5elena|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clara6elena.cn (rogue)"; content:"|0b|clara6elena|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clara7elena.cn (rogue)"; content:"|0b|clara7elena|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clara8elena.cn (rogue)"; content:"|0b|clara8elena|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup day-orange.cn (trojan)"; content:"|0a|day-orange|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dem.real-host.ru (trojan)"; content:"|03|dem|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expresstubeonline.com (fake_codec)"; content:"|11|expresstubeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-security.com (fake)"; content:"|11|facebook-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felicijan.si (rfi)"; content:"|09|felicijan|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fix-registry-here.com (rogue)"; content:"|11|fix-registry-here|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplaginsmirror.com (trojan)"; content:"|12|flashplaginsmirror|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forester66.com (rfi)"; content:"|0a|forester66|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formulatedform.com (zeus)"; content:"|0e|formulatedform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free0game.cn (malware)"; content:"|09|free0game|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeav-scan.com (fake_codec)"; content:"|0b|freeav-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geejohn.com (rfi)"; content:"|07|geejohn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-safefiles.com (trojan)"; content:"|0d|get-safefiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogovideotube.com (fake_codec)"; content:"|0d|gogovideotube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldvideocenter.com (malware)"; content:"|0f|goldvideocenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gonoristan.cn (zeus)"; content:"|0a|gonoristan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodsence.firm.in (zeus)"; content:"|09|goodsence|04|firm|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodstats1.net (rogue_antivirus)"; content:"|0a|goodstats1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guredatizer.com (malware)"; content:"|0b|guredatizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotfreestuff.net (zeus)"; content:"|0c|hotfreestuff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htm6.co.cc (trojan)"; content:"|04|htm6|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i18o.cn (exploits)"; content:"|04|i18o|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idl-maxtreasure.cn (malware)"; content:"|0f|idl-maxtreasure|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacksonville-air-conditioning.com (malware)"; content:"|1d|jacksonville-air-conditioning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kim-key.cn (rfi)"; content:"|07|kim-key|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kitichinesi.cn (malware)"; content:"|0b|kitichinesi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koryochemical.co.kr (rfi)"; content:"|0d|koryochemical|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kruptorums.com (malware)"; content:"|0a|kruptorums|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kybbt.cn (malware)"; content:"|05|kybbt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessabler.com (rfi)"; content:"|09|lessabler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lmageshack.org (trojan)"; content:"|0a|lmageshack|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamaboomboom.com (trojan)"; content:"|0c|mamaboomboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maria5clara.cn (rogue)"; content:"|0b|maria5clara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maria5sara.cn (rogue)"; content:"|0a|maria5sara|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariaclara6.cn (rogue)"; content:"|0b|mariaclara6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariaclara8.cn (rogue)"; content:"|0b|mariaclara8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariaelena6.cn (rogue)"; content:"|0b|mariaelena6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariaelena7.cn (rogue)"; content:"|0b|mariaelena7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mariaelena8.cn (rogue)"; content:"|0b|mariaelena8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaretention.com (malware)"; content:"|0e|mediaretention|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediastorageworld.com (malware)"; content:"|11|mediastorageworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megabyte.hr (rfi)"; content:"|08|megabyte|02|hr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morning1.cn (rogue_antivirus)"; content:"|08|morning1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieartscenter.com (malware)"; content:"|0f|movieartscenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieplayonline.com (malware)"; content:"|0f|movieplayonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myvirusscanner25.com (rogue)"; content:"|10|myvirusscanner25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ngelitik.org (rfi)"; content:"|08|ngelitik|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nosssasfotos.com (rfi)"; content:"|0c|nosssasfotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novatoriz.cn (malware)"; content:"|09|novatoriz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playing-sports.cn (rogue_antivirus)"; content:"|0e|playing-sports|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popkadurak.cn (exploits)"; content:"|0a|popkadurak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pr0m0.altervista.org (rfi)"; content:"|05|pr0m0|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyungan.or.kr (rfi)"; content:"|07|pyungan|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmediasoft.com (malware)"; content:"|0d|realmediasoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reastunolk.com (trojan)"; content:"|0a|reastunolk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recicladores.net (rfi)"; content:"|0c|recicladores|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shingkee.web5.pacdemo.hk (trojan)"; content:"|08|shingkee|04|web5|07|pacdemo|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sikkaro.com (exploits)"; content:"|07|sikkaro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sky-trading.com (rfi)"; content:"|0b|sky-trading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smokin57.com (rfi)"; content:"|08|smokin57|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splsystem.com (zeus)"; content:"|09|splsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportsedu.net (rfi)"; content:"|09|sportsedu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssp.co.id (rfi)"; content:"|03|ssp|02|co|02|id"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup symyho331.cn (zeus)"; content:"|09|symyho331|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup test.besst.ws (malware)"; content:"|04|test|05|besst|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theweaknes.hopto.org (trojan)"; content:"|0a|theweaknes|05|hopto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tklasx.da.ru (malware)"; content:"|06|tklasx|02|da|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topshost.info (zeus)"; content:"|08|topshost|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urj0.cn (exploits)"; content:"|04|urj0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdslprot1.com (zeus)"; content:"|09|vdslprot1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veraclara5.cn (trojan)"; content:"|0a|veraclara5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmodertp.com (zeus)"; content:"|08|vmodertp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weedruk.com (malware)"; content:"|07|weedruk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwldr.com (malware)"; content:"|06|wwwldr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7htm.co.cc (malware)"; content:"|04|7htm|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7rtf.co.cc (malware)"; content:"|04|7rtf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8rtf.co.cc (malware)"; content:"|04|8rtf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adeliouotre.com (malware)"; content:"|0b|adeliouotre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobeflashupdates.com (rogue)"; content:"|11|adobeflashupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-t.ru (malware)"; content:"|05|ads-t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads.netbios-local.com (malware)"; content:"|03|ads|0d|netbios-local|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adtcp.ru (malware)"; content:"|05|adtcp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghdg.us (malware)"; content:"|05|aghdg|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alliance-groupmain.cc (money_mule)"; content:"|12|alliance-groupmain|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingedu.com (malware)"; content:"|0a|amazingedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-pro-2010.com (rogue)"; content:"|13|anti-virus-pro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-viruspro-2010.com (rogue)"; content:"|12|anti-viruspro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pro-21.com (malware)"; content:"|10|antivirus-pro-21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro21.com (rogue)"; content:"|0e|antiviruspro21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assurity-groupco.cn (money_mule)"; content:"|10|assurity-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astrologia.org.pl (malware)"; content:"|0a|astrologia|03|org|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avirus-pro21.com (rogue)"; content:"|0c|avirus-pro21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avirusscan.com (rogue)"; content:"|0a|avirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerdriven.ru (malware)"; content:"|0c|bannerdriven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannert.ru (malware)"; content:"|07|bannert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scanpc.org (rogue)"; content:"|0b|best-scanpc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttrackerplus.in (malware)"; content:"|0f|besttrackerplus|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfs-groupinc.cc (money_mule)"; content:"|0c|bfs-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdmobile.net (malware)"; content:"|0a|birdmobile|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonacoop.asia (malware)"; content:"|08|bonacoop|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boomroot.ru (malware)"; content:"|08|boomroot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsersafeon.com (rogue)"; content:"|0d|browsersafeon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubble-preorder.info (money_mule)"; content:"|0f|bubble-preorder|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buenavistasocialclub.cn (malware)"; content:"|14|buenavistasocialclub|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buleropihertan.com (malware)"; content:"|0e|buleropihertan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calilanoticias.com (malware)"; content:"|0e|calilanoticias|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdi-groupmain.cn (money_mule)"; content:"|0d|cdi-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanyourpc-nowx.com (rogue)"; content:"|10|cleanyourpc-nowx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-antivirus03.com (rogue)"; content:"|14|computer-antivirus03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-protection03.com (rogue)"; content:"|15|computer-protection03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-protection23.com (rogue)"; content:"|15|computer-protection23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerguardsoft.com (malware)"; content:"|11|computerguardsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crekirtik.com (malware)"; content:"|09|crekirtik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dantor777.com (malware)"; content:"|09|dantor777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dastyrust.com (malware)"; content:"|09|dastyrust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decoratingcatalog.cn (malware)"; content:"|11|decoratingcatalog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deeptown.kiev.ua (malware)"; content:"|08|deeptown|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamond-dream.cc (money_mule)"; content:"|0d|diamond-dream|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dns-lookup.com (malware)"; content:"|0a|dns-lookup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotot.cn (malware)"; content:"|05|dotot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dove-groupli.cn (money_mule)"; content:"|0c|dove-groupli|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drealwebnamescan.com (rogue)"; content:"|10|drealwebnamescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dummykeath.cc (money_mule)"; content:"|0a|dummykeath|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duremaderunb.com (malware)"; content:"|0c|duremaderunb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzadsl.com (malware)"; content:"|06|dzadsl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eagle-groupmain.cn (money_mule)"; content:"|0f|eagle-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ectdeal055.cn (malware)"; content:"|0a|ectdeal055|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emnity.info (malware)"; content:"|06|emnity|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enkafuleskohuj.com (malware)"; content:"|0e|enkafuleskohuj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertonaferdogalo.com (malware)"; content:"|0f|ertonaferdogalo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertugasedumil.com (malware)"; content:"|0d|ertugasedumil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertunagertos.com (malware)"; content:"|0c|ertunagertos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastestonlinescan.com (malware)"; content:"|11|fastestonlinescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ff-aigen.at (malware)"; content:"|08|ff-aigen|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flatgroupfly.cc (money_mule)"; content:"|0c|flatgroupfly|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friedgreentomatoes.cn (malware)"; content:"|12|friedgreentomatoes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-controll.cc (money_mule)"; content:"|0d|full-controll|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geniouspartner.cn (money_mule)"; content:"|0e|geniouspartner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscancode.com (malware)"; content:"|0a|goscancode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenbeers.cn (malware)"; content:"|0a|greenbeers|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guiany.info (rogue)"; content:"|06|guiany|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htmlads.ru (injection)"; content:"|07|htmlads|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in5iv.com (rogue)"; content:"|05|in5iv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inb4iv.com (malware)"; content:"|06|inb4iv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iparkmall.co.kr (malware)"; content:"|09|iparkmall|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irisamkwang.co.kr (malware)"; content:"|0b|irisamkwang|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobfinder911.com (malware)"; content:"|0c|jobfinder911|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kazbegi.com (malware)"; content:"|07|kazbegi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup konitorsabure.com (malware)"; content:"|0d|konitorsabure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavandos8.cn (malware)"; content:"|09|lavandos8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limon4ek.cn (malware)"; content:"|08|limon4ek|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkertagubert.com (malware)"; content:"|0e|linkertagubert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveantimalwareproscanv2.com (malware)"; content:"|18|liveantimalwareproscanv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lobzik398809.com (malware)"; content:"|0c|lobzik398809|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbjenterprise.co.th (malware)"; content:"|0d|mbjenterprise|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meililai.co.kr (malware)"; content:"|08|meililai|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modestudio.co.kr (malware)"; content:"|0a|modestudio|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moldiag.ru (malware)"; content:"|07|moldiag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviemidifiles.net (malware)"; content:"|0e|moviemidifiles|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-check01.com (rogue)"; content:"|13|my-computer-check01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-check15.com (rogue)"; content:"|13|my-computer-check15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-check24.com (rogue)"; content:"|13|my-computer-check24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-scan43.com (rogue)"; content:"|12|my-computer-scan43|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-garden-state.com (malware)"; content:"|0f|my-garden-state|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantispywarecheck07.com (rogue)"; content:"|14|myantispywarecheck07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantispywarecheck11.com (rogue)"; content:"|14|myantispywarecheck11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nadvet.name (malware)"; content:"|06|nadvet|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nashi-deti.org.ua (malware)"; content:"|0a|nashi-deti|03|org|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netbios-wait.com (malware)"; content:"|0c|netbios-wait|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netronage.com (malware)"; content:"|09|netronage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niana.org (malware)"; content:"|05|niana|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npanelsrv.info (malware)"; content:"|09|npanelsrv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofaderhabewuit.com (malware)"; content:"|0e|ofaderhabewuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okavanubares.com (malware)"; content:"|0c|okavanubares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-pcscanner.com (rogue)"; content:"|10|online-pcscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-soft-payments.com (malware)"; content:"|14|online-soft-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-systemscanner.com (rogue)"; content:"|14|online-systemscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oursting.com (malware)"; content:"|08|oursting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panestate.com (money_mule)"; content:"|09|panestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pappermint.casu.net (malware)"; content:"|0a|pappermint|04|casu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partyplans.com.au (malware)"; content:"|0a|partyplans|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scan23.com (malware)"; content:"|09|pc-scan23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pctop-freescan.com (rogue)"; content:"|0e|pctop-freescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petr.mooo.com (malware)"; content:"|04|petr|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnp2bizforum.com (malware)"; content:"|0c|pnp2bizforum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preypal.org.uk (malware)"; content:"|07|preypal|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prufder.com (malware)"; content:"|07|prufder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pudurustur.com (malware)"; content:"|0a|pudurustur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqe.ru (malware)"; content:"|03|qqe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sasihuing.com (malware)"; content:"|09|sasihuing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-mypcastrologia.org.pl-now.com (rogue)"; content:"|13|scan-mypcastrologia|03|org|06|pl-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanatom6.com (rogue)"; content:"|09|scanatom6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmypc-online.com (rogue)"; content:"|0f|scanmypc-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmyzone.com (rogue)"; content:"|0a|scanmyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmyzone.net (rogue)"; content:"|0a|scanmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerscan.com (rogue)"; content:"|0b|scannerscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanweb-zone.com (rogue)"; content:"|0c|scanweb-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwebzone.net (rogue)"; content:"|0b|scanwebzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedscantoolspc.com (rogue)"; content:"|12|securedscantoolspc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securewarrior.com (malware)"; content:"|0d|securewarrior|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-field.com (rogue)"; content:"|0e|security-field|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytestinternetguide.com (rogue)"; content:"|19|securitytestinternetguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selected-antiques.com (malware)"; content:"|11|selected-antiques|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servingsupport.com (malware)"; content:"|0e|servingsupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shinchang.es.kr (malware)"; content:"|09|shinchang|02|es|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorensonsorenson13bf0.angelfire.com (malware)"; content:"|15|sorensonsorenson13bf0|09|angelfire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speha.com (malware)"; content:"|05|speha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suporte012009.xpg.com.br (malware)"; content:"|0d|suporte012009|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svazal.cn (malware)"; content:"|06|svazal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tavakulionkab.com (malware)"; content:"|0d|tavakulionkab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdos.org (malware)"; content:"|04|tdos|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testavrdown.com (rogue)"; content:"|0b|testavrdown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-offspring.cn (malware)"; content:"|0d|the-offspring|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiposoft.info (rogue)"; content:"|08|tiposoft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubanerdavaf.com (malware)"; content:"|0c|tubanerdavaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twold.info (rogue)"; content:"|05|twold|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ulsanmis.pe.kr (malware)"; content:"|08|ulsanmis|02|pe|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateadvanced.org (malware)"; content:"|0e|updateadvanced|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvgaderbotario.com (malware)"; content:"|0e|uvgaderbotario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.mobi (malware)"; content:"|07|vsdftpp|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuderinopared.com (malware)"; content:"|0d|vuderinopared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waldbauverein.de (malware)"; content:"|0d|waldbauverein|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbiztest.com (rogue)"; content:"|0a|webbiztest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weblist.xpg.com.br (malware)"; content:"|07|weblist|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whinercentral.com (malware)"; content:"|0d|whinercentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowspc-defender.com (rogue)"; content:"|12|windowspc-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup writeloveonherarms.cn (malware)"; content:"|12|writeloveonherarms|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbrowserprotection.com (rogue)"; content:"|15|yourbrowserprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abumaso3tkamid.com (malware)"; content:"|0e|abumaso3tkamid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afnhb.org (malware)"; content:"|05|afnhb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aggelies-akiniton.gr (malware)"; content:"|11|aggelies-akiniton|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfastream.cn (malware)"; content:"|0a|alfastream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anamericanbeauty.cn (malware)"; content:"|10|anamericanbeauty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaresoftware2.com (harmful)"; content:"|14|antispywaresoftware2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arabeih.cn (malware)"; content:"|07|arabeih|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aroidla.cn (malware)"; content:"|07|aroidla|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avandos8.cn (malware)"; content:"|08|avandos8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avtopizitiv.ru (malware)"; content:"|0b|avtopizitiv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbsoftwareonline.com (malware)"; content:"|10|bbsoftwareonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beofree.ru (malware)"; content:"|07|beofree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bucetinha69.t35.com (malware)"; content:"|0b|bucetinha69|03|t35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulerkoseddasko.com (malware)"; content:"|0f|bulerkoseddasko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catedralsoftware.com (malware)"; content:"|10|catedralsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbfreemarket.com (malware)"; content:"|0c|cbfreemarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cct.kaist.ac.kr (malware)"; content:"|03|cct|05|kaist|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chberger.com (malware)"; content:"|08|chberger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkmalware02.com (rogue)"; content:"|0e|checkmalware02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup children-life.ru (malware)"; content:"|0d|children-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chingyoung.net16.net (malware)"; content:"|0a|chingyoung|05|net16|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cidc.org.ru (malware)"; content:"|04|cidc|03|org|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup client158.faster-hosting.com (malware)"; content:"|09|client158|0e|faster-hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2684.supermishka.com (malware)"; content:"|08|core2684|0b|supermishka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2770.punktnaznachenia.com (malware)"; content:"|08|core2770|10|punktnaznachenia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cremuklip.com (malware)"; content:"|09|cremuklip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cubicolor.fr (malware)"; content:"|09|cubicolor|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuturanger.com (malware)"; content:"|0a|cuturanger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d2707.com (malware)"; content:"|05|d2707|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dabertugaburav.com (malware)"; content:"|0e|dabertugaburav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfrgc.cn (malware)"; content:"|05|dfrgc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duffimail.info (malware)"; content:"|09|duffimail|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edit1china.cn (malware)"; content:"|0a|edit1china|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edit2china.cn (malware)"; content:"|0a|edit2china|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edit3china.cn (malware)"; content:"|0a|edit3china|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emailsmms.kit.net (malware)"; content:"|09|emailsmms|03|kit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertanueskayert.com (malware)"; content:"|0e|ertanueskayert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erubamerkadolo.com (malware)"; content:"|0e|erubamerkadolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evaracollin.be (kopobface)"; content:"|0b|evaracollin|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasurinoking.com (malware)"; content:"|0c|fasurinoking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fcc7.cn (malware)"; content:"|04|fcc7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floweragents.com (malware)"; content:"|0c|floweragents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fmmkor.org (malware)"; content:"|06|fmmkor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forad.cz (malware)"; content:"|05|forad|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fzegarox.cn (malware)"; content:"|08|fzegarox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galeon.com (malware)"; content:"|06|galeon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamlabodens.se (malware)"; content:"|0b|gamlabodens|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcillustration.com (harmful)"; content:"|0e|gcillustration|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geektuned.com (abusive)"; content:"|09|geektuned|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geh-ins.kz (malware)"; content:"|07|geh-ins|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup germanamericantax.com (abusive)"; content:"|11|germanamericantax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-free-files.com (malware)"; content:"|0e|get-free-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-freescan.com (malware)"; content:"|0c|get-freescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogopub.cn (malware)"; content:"|07|gogopub|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldwonderful9.info (money_mule)"; content:"|0e|goldwonderful9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golf-dieppe.com (malware)"; content:"|0b|golf-dieppe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorillazband.cn (malware)"; content:"|0c|gorillazband|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harmonyhudospa.se (abusive)"; content:"|0e|harmonyhudospa|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidost.com (malware)"; content:"|06|hidost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtosecyourpcsnow.com (rogue)"; content:"|12|howtosecyourpcsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsheval.com (malware)"; content:"|07|hsheval|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyedafox.cn (malware)"; content:"|08|hyedafox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieguide.co.kr (malware)"; content:"|07|ieguide|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingatlanforgalmazas.hu (malware)"; content:"|13|ingatlanforgalmazas|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixuyna.cn (malware)"; content:"|06|ixuyna|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jifekwy.cn (malware)"; content:"|07|jifekwy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimzeky.cn (malware)"; content:"|07|jimzeky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keygroupmain.cn (money_mule)"; content:"|0c|keygroupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfredukilo.com (malware)"; content:"|0a|kfredukilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kodosa.co.kr (malware)"; content:"|06|kodosa|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koenvanroy.be (malware)"; content:"|0a|koenvanroy|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kostinporest.com (malware)"; content:"|0c|kostinporest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktvsongs.com (koobface)"; content:"|08|ktvsongs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastspy.info (rogue)"; content:"|07|lastspy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lawfirmincubator.com (malware)"; content:"|10|lawfirmincubator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libertygroup.cc (money_mule)"; content:"|0c|libertygroup|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lime-groupnet.cn (money_mule)"; content:"|0d|lime-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lime-groupsvc.cn (money_mule)"; content:"|0d|lime-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listtubeonline.com (malware)"; content:"|0e|listtubeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowatt.info (malware)"; content:"|06|lowatt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lr-online.dk (koobface)"; content:"|09|lr-online|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luinstra-vt.nl (malware)"; content:"|0b|luinstra-vt|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maple.k-league.ca (malware)"; content:"|05|maple|08|k-league|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcalanfreedman.com (malware)"; content:"|10|marcalanfreedman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martinhorngren.com (koobface)"; content:"|0e|martinhorngren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup massivegroupsvc.cn (money_mule)"; content:"|0f|massivegroupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcreativeservices.com (abusive)"; content:"|11|mcreativeservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meanly.info (malware)"; content:"|06|meanly|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasiti.com (malware)"; content:"|08|megasiti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melson-groupmain.com (money_mule)"; content:"|10|melson-groupmain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meroeart.com (abusive)"; content:"|08|meroeart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro.deepfoto.eu (malware)"; content:"|05|micro|08|deepfoto|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modulobradesco.com (malware)"; content:"|0e|modulobradesco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molodej.in.ua (abusive)"; content:"|07|molodej|02|in|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup montaguekorea.com (malware)"; content:"|0d|montaguekorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantispywarecheck00.com (rogue)"; content:"|14|myantispywarecheck00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myndir.fotbolti.net (malware)"; content:"|06|myndir|08|fotbolti|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypoints.kr (malware)"; content:"|08|mypoints|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkmaniasecrets.com (harmful)"; content:"|13|networkmaniasecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-plugin.com (malware)"; content:"|0a|new-plugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtoolsonline.com (malware)"; content:"|0e|newtoolsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlc.or.kr (malware)"; content:"|03|nlc|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nroof.info (malware)"; content:"|05|nroof|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsync.filipinaprincess.com (abusive)"; content:"|05|nsync|10|filipinaprincess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohsn.org (malware)"; content:"|04|ohsn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opm-group.cn (money_mule)"; content:"|09|opm-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opm-groupli.com (money_mule)"; content:"|0b|opm-groupli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orav4abustorabe.com (malware)"; content:"|0f|orav4abustorabe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-guard.com (rogue)"; content:"|08|os-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-shield.com (rogue)"; content:"|09|os-shield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parasecurityscans.com (rogue)"; content:"|11|parasecurityscans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partnergreatest8.net (money_mule)"; content:"|10|partnergreatest8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup party-reunite.cc (money_mule)"; content:"|0d|party-reunite|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-bug-remover.com (rogue)"; content:"|0e|pc-bug-remover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pconline-guard.com (rogue)"; content:"|0e|pconline-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipetubesite.com (malware)"; content:"|0c|pipetubesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntubehunt.com (malware)"; content:"|0c|porntubehunt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premier-groupinc.cn (money_mule)"; content:"|10|premier-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premier-groupnet.cn (money_mule)"; content:"|10|premier-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup punktnaznachenia.com (malware)"; content:"|10|punktnaznachenia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-antimalware-2.com (harmful)"; content:"|13|quick-antimalware-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicksilverminutes.quicksilvercopywriters.com (malware)"; content:"|12|quicksilverminutes|16|quicksilvercopywriters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0tfii11.net (phishing)"; content:"|07|0tfii11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0tfiil1.com (phishing)"; content:"|07|0tfiil1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0tfiil1.net (phishing)"; content:"|07|0tfiil1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10zz.co.cc (zeus)"; content:"|04|10zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 11sp.co.cc (zeus)"; content:"|04|11sp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 15zz.co.cc (zeus)"; content:"|04|15zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ptfiili.net (phishing)"; content:"|08|1ptfiili|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ptfiill.com (phishing)"; content:"|08|1ptfiill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ptfilli.com (phishing)"; content:"|08|1ptfilli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1zzz.co.cc (zeus)"; content:"|04|1zzz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3allfolderscan.com (rogue)"; content:"|0e|3allfolderscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7pp7.net (zeus)"; content:"|04|7pp7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 852159.com (zeus)"; content:"|06|852159|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9zz.co.cc (zeus)"; content:"|03|9zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angryshark.cn (zeus)"; content:"|0a|angryshark|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarecomputerscan01.com (rogue)"; content:"|19|antispywarecomputerscan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aproximosstyle0112.net (zeus)"; content:"|12|aproximosstyle0112|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqazar.co.uk (phishing)"; content:"|06|aqazar|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqazaw.co.uk (phishing)"; content:"|06|aqazaw|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artsmartint.net (malware)"; content:"|0b|artsmartint|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-plus-2009.com (rogue)"; content:"|0c|av-plus-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankavenu.com (zeus)"; content:"|09|bankavenu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszf.co.uk (phishing)"; content:"|07|beraszf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszf.eu (phishing)"; content:"|07|beraszf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszf.me.uk (phishing)"; content:"|07|beraszf|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszz.co.uk (phishing)"; content:"|07|beraszz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszz.eu (phishing)"; content:"|07|beraszz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beraszz.me.uk (phishing)"; content:"|07|beraszz|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffe.co.uk (malspam)"; content:"|08|bertdffe|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffe.eu (malspam)"; content:"|08|bertdffe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffm.co.uk (malspam)"; content:"|08|bertdffm|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffm.eu (malspam)"; content:"|08|bertdffm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffo.eu (malspam)"; content:"|08|bertdffo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffw.co.uk (malspam)"; content:"|08|bertdffw|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertdffw.eu (malspam)"; content:"|08|bertdffw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scan-pc.com (rogue)"; content:"|0c|best-scan-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispyware7.com (rogue)"; content:"|10|bestantispyware7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestspywarescanner05.com (rogue)"; content:"|14|bestspywarescanner05|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestspywarescanner12.com (rogue)"; content:"|14|bestspywarescanner12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestspywarescanner15.com (rogue)"; content:"|14|bestspywarescanner15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezfazsda.eu (phishing)"; content:"|09|bezfazsda|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brclscounter.com (zeus)"; content:"|0c|brclscounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byuuhgn.com (phishing)"; content:"|07|byuuhgn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byuuhgo.eu (phishing)"; content:"|07|byuuhgo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byuuhgt.com (phishing)"; content:"|07|byuuhgt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byuuhgz.com (phishing)"; content:"|07|byuuhgz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byyyhze.eu (phishing)"; content:"|07|byyyhze|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byyyhzi.co.uk (phishing)"; content:"|07|byyyhzi|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccviilli.net (phishing)"; content:"|08|ccviilli|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccviilll.net (phishing)"; content:"|08|ccviilll|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosasmias.com (zeus)"; content:"|09|cosasmias|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dferffdc.eu (phishing)"; content:"|08|dferffdc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dferffdx.co.uk (phishing)"; content:"|08|dferffdx|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dferffdx.com (phishing)"; content:"|08|dferffdx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disturbedweb.cn (malware)"; content:"|0c|disturbedweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekoarts-sd.com (malware)"; content:"|0a|ekoarts-sd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evipshop.com (zeus)"; content:"|08|evipshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup express-currency.com (zeus)"; content:"|10|express-currency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbheadquaters.cn (zeus)"; content:"|0d|fbheadquaters|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedzzab.eu (phishing)"; content:"|07|fedzzab|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedzzai.eu (phishing)"; content:"|07|fedzzai|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedzzas.eu (phishing)"; content:"|07|fedzzas|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferdaswq.com (phishing)"; content:"|08|ferdaswq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferdaswr.com (phishing)"; content:"|08|ferdaswr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forexbids.cn (malware)"; content:"|09|forexbids|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forwardartstools.com (malware)"; content:"|10|forwardartstools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1i.com (phishing)"; content:"|08|gerfas1i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1i.eu (phishing)"; content:"|08|gerfas1i|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1i.net (phishing)"; content:"|08|gerfas1i|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1j.com (phishing)"; content:"|08|gerfas1j|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1k.com (phishing)"; content:"|08|gerfas1k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1k.net (phishing)"; content:"|08|gerfas1k|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1m.com (phishing)"; content:"|08|gerfas1m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfas1m.eu (phishing)"; content:"|08|gerfas1m|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerradsz1.co.ee (phishing)"; content:"|09|gerradsz1|02|co|02|ee"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerradsz1.com (phishing)"; content:"|09|gerradsz1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerradsz1.eu (phishing)"; content:"|09|gerradsz1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getfreediscounts.cn (malware)"; content:"|10|getfreediscounts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-av-2010.com (rogue)"; content:"|0d|green-av-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haaszap.com (phishing)"; content:"|07|haaszap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haqwaz1.co.im (phishing)"; content:"|07|haqwaz1|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haqwaz1.com.im (phishing)"; content:"|07|haqwaz1|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haqwaz1.im (phishing)"; content:"|07|haqwaz1|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haqwaz1.net.im (phishing)"; content:"|07|haqwaz1|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hometoolsonline.com (rogue)"; content:"|0f|hometoolsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hq-tube-porn.com (trojan)"; content:"|0c|hq-tube-porn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyu111a.com (phishing)"; content:"|07|hyu111a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf1.cn (phishing)"; content:"|07|hyyyyf1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf3.cn (phishing)"; content:"|07|hyyyyf3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf4.cn (phishing)"; content:"|07|hyyyyf4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf5.cn (phishing)"; content:"|07|hyyyyf5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf7.cn (phishing)"; content:"|07|hyyyyf7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyyyyf8.cn (phishing)"; content:"|07|hyyyyf8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiitkiil.net (phishing)"; content:"|08|iiitkiil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiitklil.com (phishing)"; content:"|08|iiitklil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup individualpeople.org (money_mule)"; content:"|10|individualpeople|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkoclear.info (trojan)"; content:"|09|inkoclear|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internationalbrandimage.com (money_mule)"; content:"|17|internationalbrandimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivirus4.com (rogue)"; content:"|13|internet-antivirus4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivirus9.com (malware)"; content:"|13|internet-antivirus9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iptfiili.com (phishing)"; content:"|08|iptfiili|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iptfiili.net (phishing)"; content:"|08|iptfiili|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iptfiill.com (phishing)"; content:"|08|iptfiill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihaa.co.uk (phishing)"; content:"|06|juihaa|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihaa.me (phishing)"; content:"|06|juihaa|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihah.co.uk (phishing)"; content:"|06|juihah|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihaq.co.uk (phishing)"; content:"|06|juihaq|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihar.co.uk (phishing)"; content:"|06|juihar|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihas.me (phishing)"; content:"|06|juihas|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihat.co.uk (phishing)"; content:"|06|juihat|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihax.co.uk (phishing)"; content:"|06|juihax|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihax.me (phishing)"; content:"|06|juihax|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihaz.co.uk (phishing)"; content:"|06|juihaz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juihaz.me (phishing)"; content:"|06|juihaz|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justpaythis.cn (zeus)"; content:"|0b|justpaythis|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lekiraovnie3.cn (zeus)"; content:"|0c|lekiraovnie3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liitkiil.net (phishing)"; content:"|08|liitkiil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listhtml.info (zeus)"; content:"|08|listhtml|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scanner.biz (trojan)"; content:"|0f|malware-scanner|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scanner.info (trojan)"; content:"|0f|malware-scanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scanner.net (trojan)"; content:"|0f|malware-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-stop.com (trojan)"; content:"|0c|malware-stop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-stop.info (trojan)"; content:"|0c|malware-stop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashrumm.bissnes.net (zeus)"; content:"|08|mashrumm|07|bissnes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media1960.cn (zeus)"; content:"|09|media1960|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movie-paradise.com (zeus)"; content:"|0e|movie-paradise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrvtpp101.be (phishing)"; content:"|0a|msrvtpp101|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrvtpp102.be (phishing)"; content:"|0a|msrvtpp102|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrvtpp102.com (phishing)"; content:"|0a|msrvtpp102|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrvtpp103.com (phishing)"; content:"|0a|msrvtpp103|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msrvtpp103.eu (phishing)"; content:"|0a|msrvtpp103|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtfii11.net (phishing)"; content:"|07|mtfii11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtfiil1.net (phishing)"; content:"|07|mtfiil1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtfill1.net (phishing)"; content:"|07|mtfill1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-pc-scanner7.com (rogue)"; content:"|0e|my-pc-scanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerantispy04.com (rogue)"; content:"|13|mycomputerantispy04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspyware-scan12.com (rogue)"; content:"|10|myspyware-scan12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspyware-scanner2.com (rogue)"; content:"|12|myspyware-scanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n950.info (zeus)"; content:"|04|n950|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaasa.com (phishing)"; content:"|08|nerfaasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaash.com (phishing)"; content:"|08|nerfaash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaash.eu (phishing)"; content:"|08|nerfaash|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaasl.com (phishing)"; content:"|08|nerfaasl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaasm.eu (phishing)"; content:"|08|nerfaasm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaasx.com (phishing)"; content:"|08|nerfaasx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerfaasz.com (phishing)"; content:"|08|nerfaasz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssb.eu (malspam)"; content:"|09|nerrasssb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrassso.eu (malspam)"; content:"|09|nerrassso|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssp.co.uk (malspam)"; content:"|09|nerrasssp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssp.eu (malspam)"; content:"|09|nerrasssp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrassst.co.uk (malspam)"; content:"|09|nerrassst|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrassst.eu (malspam)"; content:"|09|nerrassst|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssu.co.uk (malspam)"; content:"|09|nerrasssu|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssu.eu (malspam)"; content:"|09|nerrasssu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssw.co.uk (malspam)"; content:"|09|nerrasssw|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssw.eu (malspam)"; content:"|09|nerrasssw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssx.co.uk (malspam)"; content:"|09|nerrasssx|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssx.eu (malspam)"; content:"|09|nerrasssx|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssy.co.uk (malspam)"; content:"|09|nerrasssy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerrasssy.eu (malspam)"; content:"|09|nerrasssy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netcaraudit.com (rogue)"; content:"|0b|netcaraudit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikka.crkrxer.net (zeus)"; content:"|05|nikka|07|crkrxer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup norah-jones.cn (malware)"; content:"|0b|norah-jones|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nortel-antivirus-pro.com (rogue)"; content:"|14|nortel-antivirus-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nortel2010.com (rogue)"; content:"|0a|nortel2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhhh12a.co.uk (phishing)"; content:"|08|nyhhh12a|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhhh12a.eu (phishing)"; content:"|08|nyhhh12a|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhhh12e.co.uk (phishing)"; content:"|08|nyhhh12e|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhhh12r.co.uk (phishing)"; content:"|08|nyhhh12r|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyhhh12r.eu (phishing)"; content:"|08|nyhhh12r|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhc.com (phishing)"; content:"|06|nyuhhc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhf.com (phishing)"; content:"|06|nyuhhf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhh.com (phishing)"; content:"|06|nyuhhh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhr.com (phishing)"; content:"|06|nyuhhr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhht.com (phishing)"; content:"|06|nyuhht|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhu.com (phishing)"; content:"|06|nyuhhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhv.com (phishing)"; content:"|06|nyuhhv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhx.com (phishing)"; content:"|06|nyuhhx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhy.com (phishing)"; content:"|06|nyuhhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuhhz.com (phishing)"; content:"|06|nyuhhz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuvvas.com (phishing)"; content:"|07|nyuvvas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuvvas.net (phishing)"; content:"|07|nyuvvas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz1a.com (phishing)"; content:"|06|nyuz1a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz1a.net (phishing)"; content:"|06|nyuz1a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz2a.com (phishing)"; content:"|06|nyuz2a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz3a.com (phishing)"; content:"|06|nyuz3a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz3a.net (phishing)"; content:"|06|nyuz3a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz4a.net (phishing)"; content:"|06|nyuz4a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz5a.com (phishing)"; content:"|06|nyuz5a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuz5a.net (phishing)"; content:"|06|nyuz5a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyyherdx.net (phishing)"; content:"|08|nyyherdx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyyherdy.net (phishing)"; content:"|08|nyyherdy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkua.co.uk (malspam)"; content:"|08|oikkkkua|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkua.eu (malspam)"; content:"|08|oikkkkua|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuf.co.uk (malspam)"; content:"|08|oikkkkuf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuf.eu (malspam)"; content:"|08|oikkkkuf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuh.co.uk (malspam)"; content:"|08|oikkkkuh|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuh.eu (malspam)"; content:"|08|oikkkkuh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuy.co.uk (malspam)"; content:"|08|oikkkkuy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oikkkkuy.eu (malspam)"; content:"|08|oikkkkuy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otfii11.com (phishing)"; content:"|07|otfii11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otfii11.net (phishing)"; content:"|07|otfii11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otfill1.com (phishing)"; content:"|07|otfill1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paul-mc-cartney.cn (malware)"; content:"|0f|paul-mc-cartney|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcfastest-onlinedefend.com (trojan)"; content:"|16|pcfastest-onlinedefend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoenixgroupco.cn (fraud)"; content:"|0e|phoenixgroupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikka.eu (malspam)"; content:"|07|polikka|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikki.co.uk (malspam)"; content:"|07|polikki|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikki.eu (malspam)"; content:"|07|polikki|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikko.co.uk (malspam)"; content:"|07|polikko|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikko.eu (malspam)"; content:"|07|polikko|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikkp.co.uk (malspam)"; content:"|07|polikkp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polikkp.eu (malspam)"; content:"|07|polikkp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-free-tube.biz (trojan)"; content:"|0e|porn-free-tube|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-tube-for-free.org (trojan)"; content:"|12|porn-tube-for-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proname.biz (zeus)"; content:"|07|proname|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectedfield.com (harmful)"; content:"|0e|protectedfield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptfii11.net (phishing)"; content:"|07|ptfii11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptfiil1.net (phishing)"; content:"|07|ptfiil1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptfill1.com (phishing)"; content:"|07|ptfill1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptfill1.net (phishing)"; content:"|07|ptfill1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqrehk.net (phishing)"; content:"|07|qqqrehk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqreho.net (phishing)"; content:"|07|qqqreho|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqrehy.com (phishing)"; content:"|07|qqqrehy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqrehy.net (phishing)"; content:"|07|qqqrehy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retropc-checker.com (trojan)"; content:"|0f|retropc-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roop.barxlays.co.uk (zeus)"; content:"|04|roop|08|barxlays|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rpmm0.cn (zeus)"; content:"|05|rpmm0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safefighter.com (rogue)"; content:"|0b|safefighter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-networks.cn (zeus)"; content:"|0f|secure-networks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityinfos4you.com (rogue)"; content:"|11|securityinfos4you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitymilescan.com (rogue)"; content:"|10|securitymilescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftwareinternet.com (rogue)"; content:"|18|securitysoftwareinternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsavailable.com (rogue)"; content:"|16|securitytoolsavailable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sersoft.eu (trojan)"; content:"|07|sersoft|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sftzone2009.cn (rogue)"; content:"|0b|sftzone2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup st-resources.net (zeus)"; content:"|0c|st-resources|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stabilitytoolsonline.com (rogue)"; content:"|14|stabilitytoolsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statcareonline.com (zeus)"; content:"|0e|statcareonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-malware.biz (trojan)"; content:"|0c|stop-malware|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-spyware.biz (trojan)"; content:"|0c|stop-spyware|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup student.velv.hr (zeus)"; content:"|07|student|04|velv|02|hr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supercleanonline.com (trojan)"; content:"|10|supercleanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superdeletethreat.com (trojan)"; content:"|11|superdeletethreat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supergame978jnnn2.com (zeus)"; content:"|11|supergame978jnnn2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsmc.co.im (phishing)"; content:"|05|tdsmc|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsmc.com.im (phishing)"; content:"|05|tdsmc|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsmc.im (phishing)"; content:"|05|tdsmc|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsmc.net.im (phishing)"; content:"|05|tdsmc|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsmc.org.im (phishing)"; content:"|05|tdsmc|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebfdshop.com (zeus)"; content:"|0a|thebfdshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenetdetect.com (rogue)"; content:"|0c|thenetdetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiitkiil.com (phishing)"; content:"|08|tiitkiil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiitkiil.eu (phishing)"; content:"|08|tiitkiil|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiitkiil.net (phishing)"; content:"|08|tiitkiil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiitklil.com (phishing)"; content:"|08|tiitklil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiitklil.net (phishing)"; content:"|08|tiitklil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timezscanner.com (trojan)"; content:"|0c|timezscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiuokan.com (zeus)"; content:"|07|tiuokan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolsonlinedirect.com (rogue)"; content:"|11|toolsonlinedirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolsonlineworld.com (rogue)"; content:"|10|toolsonlineworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topshost.biz (zeus)"; content:"|08|topshost|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toringgo.cn (zeus)"; content:"|08|toringgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficsupple.ru (zeus)"; content:"|0d|trafficsupple|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojanremoverpc.com (rogue)"; content:"|0f|trojanremoverpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustlevel.biz (zeus)"; content:"|0a|trustlevel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup try-your-destiny.cn (malware)"; content:"|10|try-your-destiny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaseacubmw.com (zeus)"; content:"|0a|vaseacubmw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsl.co.im (phishing)"; content:"|04|vdsl|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsl.com.im (phishing)"; content:"|04|vdsl|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsl.im (phishing)"; content:"|04|vdsl|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsl.net.im (phishing)"; content:"|04|vdsl|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsl.org.im (phishing)"; content:"|04|vdsl|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipbuyguide.com (zeus)"; content:"|0b|vipbuyguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vs.strangled.net (zeus)"; content:"|02|vs|09|strangled|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.biz (phishing)"; content:"|07|vsdftpp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.com (phishing)"; content:"|07|vsdftpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.info (phishing)"; content:"|07|vsdftpp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.net (phishing)"; content:"|07|vsdftpp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdftpp.org (phishing)"; content:"|07|vsdftpp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtfii11.net (phishing)"; content:"|07|vtfii11|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wa0.ru (zeus)"; content:"|03|wa0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watermelonfun.cn (harmful)"; content:"|0d|watermelonfun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webhosttest.com (rogue)"; content:"|0b|webhosttest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-pcdefender.com (rogue)"; content:"|12|windows-pcdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsenterprisedefender.com (rogue)"; content:"|19|windowsenterprisedefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world-tube-free.biz (trojan)"; content:"|0f|world-tube-free|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world-tube-free.info (trojan)"; content:"|0f|world-tube-free|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdec.eu (malspam)"; content:"|07|wsasdec|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdep.co.uk (malspam)"; content:"|07|wsasdep|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdep.eu (malspam)"; content:"|07|wsasdep|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasder.co.uk (malspam)"; content:"|07|wsasder|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasder.eu (malspam)"; content:"|07|wsasder|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdev.co.uk (malspam)"; content:"|07|wsasdev|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdev.eu (malspam)"; content:"|07|wsasdev|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsasdez.co.uk (malspam)"; content:"|07|wsasdez|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wunabarakati.com (zeus)"; content:"|0c|wunabarakati|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiitkiil.net (phishing)"; content:"|08|xiitkiil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxawq10.com (phishing)"; content:"|07|xxawq10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yersfde.com (phishing)"; content:"|07|yersfde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yersfde.net (phishing)"; content:"|07|yersfde|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh10a.cn (phishing)"; content:"|07|yhhh10a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh13a.cn (phishing)"; content:"|07|yhhh13a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh14a.cn (phishing)"; content:"|07|yhhh14a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh15a.cn (phishing)"; content:"|07|yhhh15a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh17a.com (phishing)"; content:"|07|yhhh17a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh18a.cn (phishing)"; content:"|07|yhhh18a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh19a.cn (phishing)"; content:"|07|yhhh19a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh19a.com (phishing)"; content:"|07|yhhh19a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a1.cn (phishing)"; content:"|07|yhhh1a1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a2.cn (phishing)"; content:"|07|yhhh1a2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a3.cn (phishing)"; content:"|07|yhhh1a3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a4.cn (phishing)"; content:"|07|yhhh1a4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a5.cn (phishing)"; content:"|07|yhhh1a5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a6.cn (phishing)"; content:"|07|yhhh1a6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhh1a8.com (phishing)"; content:"|07|yhhh1a8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhssza.com (phishing)"; content:"|07|yhhssza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszi.com (phishing)"; content:"|07|yhhsszi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszo.com (phishing)"; content:"|07|yhhsszo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszo.eu (phishing)"; content:"|07|yhhsszo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszp.com (phishing)"; content:"|07|yhhsszp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszz.com (phishing)"; content:"|07|yhhsszz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhsszz.net (phishing)"; content:"|07|yhhsszz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeleboba.com (zeus)"; content:"|08|zeleboba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeusformyfriend.com (zeus)"; content:"|0f|zeusformyfriend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100-web-top.ru (exploits)"; content:"|0b|100-web-top|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2cash.us (trojan)"; content:"|05|2cash|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2tvtube.com (trojan)"; content:"|07|2tvtube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aa88567.cn (threat)"; content:"|07|aa88567|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abcuylyetn.com (exploits)"; content:"|0a|abcuylyetn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-block-13.info (exploits)"; content:"|0c|ads-block-13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-2010pro.com (rogue)"; content:"|11|antivirus-2010pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleaboard.com (fraud_scam)"; content:"|0b|appleaboard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleaccident.com (fraud_scam)"; content:"|0d|appleaccident|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleaccording.com (fraud_scam)"; content:"|0e|appleaccording|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleaccurate.com (fraud_scam)"; content:"|0d|appleaccurate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleacross.com (fraud_scam)"; content:"|0b|appleacross|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appleactual.com (fraud_scam)"; content:"|0b|appleactual|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avast-avast.info (rogue)"; content:"|0b|avast-avast|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azvtracker.info (zeus)"; content:"|0a|azvtracker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basesecuritypromo.com (rogue)"; content:"|11|basesecuritypromo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bckjtrkg.info (fraud_scam)"; content:"|08|bckjtrkg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besort.info (rogue)"; content:"|06|besort|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-kicks.net (fraud_scam)"; content:"|0a|best-kicks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogoservice.cn (fraud_scam)"; content:"|0b|bogoservice|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boostpcsite.com (trojan)"; content:"|0b|boostpcsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bporntube.com (trojan)"; content:"|09|bporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brand-supplier.com (fraud_scam)"; content:"|0e|brand-supplier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brand-supplier.net (fraud_scam)"; content:"|0e|brand-supplier|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-house.com (fraud_scam)"; content:"|0c|brands-house|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-house.net (fraud_scam)"; content:"|0c|brands-house|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-sales.com (fraud_scam)"; content:"|0c|brands-sales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-stock.com (fraud_scam)"; content:"|0c|brands-stock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-stock.net (fraud_scam)"; content:"|0c|brands-stock|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-vendor.com (fraud_scam)"; content:"|0d|brands-vendor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-vendors.com (fraud_scam)"; content:"|0e|brands-vendors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brands-vendors.net (fraud_scam)"; content:"|0e|brands-vendors|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burgerstreet.cn (malware)"; content:"|0c|burgerstreet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccleaner-portable.com (rogue)"; content:"|11|ccleaner-portable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccleaner-portable.info (rogue)"; content:"|11|ccleaner-portable|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccn-group.cc (fraud_scam)"; content:"|09|ccn-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccn-groupco.cc (fraud_scam)"; content:"|0b|ccn-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccn-groupco.cn (fraud_scam)"; content:"|0b|ccn-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccn-groupsvc.cn (fraud_scam)"; content:"|0c|ccn-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheir.info (rogue)"; content:"|05|cheir|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolcruising.cn (scam)"; content:"|0c|coolcruising|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter-block-11.info (exploits)"; content:"|10|counter-block-11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter13.info (exploits)"; content:"|09|counter13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crabcity.cn (malware)"; content:"|08|crabcity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criscom-group.cc (fraud_scam)"; content:"|0d|criscom-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criscom-groupinc.cc (fraud_scam)"; content:"|10|criscom-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criscom-groupinc.cn (fraud_scam)"; content:"|10|criscom-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criscomgroupco.cn (fraud_scam)"; content:"|0e|criscomgroupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup den-payments.com (fraud_scam)"; content:"|0c|den-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discounts-shop.com (fraud_scam)"; content:"|0e|discounts-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discounts-shop.net (fraud_scam)"; content:"|0e|discounts-shop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discounts-store.com (fraud_scam)"; content:"|0f|discounts-store|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discounts-store.net (fraud_scam)"; content:"|0f|discounts-store|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlpersgd09.com (rogue)"; content:"|0a|dlpersgd09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dowinscanpcs.com (rogue)"; content:"|0c|dowinscanpcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drovosek.org (malware)"; content:"|08|drovosek|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dumpscard.cn (fraud_scam)"; content:"|09|dumpscard|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dutyfreeairport.cn (fraud_scam)"; content:"|0f|dutyfreeairport|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dy2004.com (malware)"; content:"|06|dy2004|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-buypharmacy.com (fraud_scam)"; content:"|0d|e-buypharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup einrock.com (malware)"; content:"|07|einrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faadora.cn (fraud_scam)"; content:"|07|faadora|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairline-group.cc (fraud_scam)"; content:"|0e|fairline-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairline-group.cn (fraud_scam)"; content:"|0e|fairline-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairline-groupinc.cc (fraud_scam)"; content:"|11|fairline-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairline-groupinc.cn (fraud_scam)"; content:"|11|fairline-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farmers-trader.net (fraud_scam)"; content:"|0e|farmers-trader|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashion-vendors.com (fraud_scam)"; content:"|0f|fashion-vendors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashion-vendors.net (fraud_scam)"; content:"|0f|fashion-vendors|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstroyal.cn (scam)"; content:"|0a|firstroyal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fopsl.cn (exploits)"; content:"|05|fopsl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freiny.info (rogue)"; content:"|06|freiny|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girded.info (rogue)"; content:"|06|girded|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godirscan.com (rogue)"; content:"|09|godirscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goeasescan.com (rogue)"; content:"|0a|goeasescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gonamescan.com (rogue)"; content:"|0a|gonamescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanadd.com (rogue)"; content:"|09|goscanadd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscandir.com (rogue)"; content:"|09|goscandir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscandoer.com (rogue)"; content:"|0a|goscandoer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanease.com (rogue)"; content:"|0a|goscanease|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscankeep.com (rogue)"; content:"|0a|goscankeep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanlike.com (rogue)"; content:"|0a|goscanlike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanmute.com (rogue)"; content:"|0a|goscanmute|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanneat.com (rogue)"; content:"|0a|goscanneat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanpick.com (rogue)"; content:"|0a|goscanpick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscansole.com (rogue)"; content:"|0a|goscansole|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscantrio.com (rogue)"; content:"|0a|goscantrio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goscanxtra.com (rogue)"; content:"|0a|goscanxtra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosolescan.com (rogue)"; content:"|0a|gosolescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hozerun.cn (malware)"; content:"|07|hozerun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hq-watches.com (fraud_scam)"; content:"|0a|hq-watches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icqtel.ru (exploits)"; content:"|06|icqtel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in5ct.com (rogue)"; content:"|05|in5ct|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in5it.com (rogue)"; content:"|05|in5it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inb6it.com (rogue)"; content:"|06|inb6it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inb6sq.com (rogue)"; content:"|06|inb6sq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrity-groupinc.cc (fraud_scam)"; content:"|12|integrity-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrity-groupsvc.com (fraud_scam)"; content:"|12|integrity-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invalda-groupli.cn (fraud_scam)"; content:"|0f|invalda-groupli|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invalda-groupli.com (fraud_scam)"; content:"|0f|invalda-groupli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invalda-groupmain.com (fraud_scam)"; content:"|11|invalda-groupmain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investmentallianceltd.com (fraud_scam)"; content:"|15|investmentallianceltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanvyz.cn (rogue)"; content:"|06|kanvyz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaxuze.cn (rogue)"; content:"|06|kaxuze|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-buy.com (fraud_scam)"; content:"|09|kicks-buy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-buy.net (fraud_scam)"; content:"|09|kicks-buy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-discount.com (fraud_scam)"; content:"|0e|kicks-discount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-discount.net (fraud_scam)"; content:"|0e|kicks-discount|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-discounts.com (fraud_scam)"; content:"|0f|kicks-discounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-discounts.net (fraud_scam)"; content:"|0f|kicks-discounts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-shop.com (fraud_scam)"; content:"|0a|kicks-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-stock.com (fraud_scam)"; content:"|0b|kicks-stock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-supplier.com (fraud_scam)"; content:"|0e|kicks-supplier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-vendors.com (fraud_scam)"; content:"|0d|kicks-vendors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kicks-vendors.net (fraud_scam)"; content:"|0d|kicks-vendors|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kivokonly.com (trojan)"; content:"|09|kivokonly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavolt.info (rogue)"; content:"|06|lavolt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup life93.com (malware)"; content:"|06|life93|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lime-groupsvc.com (fraud_scam)"; content:"|0d|lime-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logartos.org (malware)"; content:"|08|logartos|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxury-stock.com (fraud_scam)"; content:"|0c|luxury-stock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup majimura.com (malware)"; content:"|08|majimura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makomset.com (malware)"; content:"|08|makomset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwaredetectsite.com (trojan)"; content:"|11|malwaredetectsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup margin-group.cc (fraud_scam)"; content:"|0c|margin-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup margin-groupco.cc (fraud_scam)"; content:"|0e|margin-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup margin-groupco.cn (fraud_scam)"; content:"|0e|margin-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup margingroupinc.cn (fraud_scam)"; content:"|0e|margingroupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moranna.com (fraud_scam)"; content:"|07|moranna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mxm-host.net (malware)"; content:"|08|mxm-host|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecurityupgrade.com (trojan)"; content:"|11|mysecurityupgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naj1za.eu (zbot)"; content:"|06|naj1za|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neo-job.com (fraud_scam)"; content:"|07|neo-job|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neoinvestmentgroup.com (fraud_scam)"; content:"|12|neoinvestmentgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neoinvestmentllp.com (fraud_scam)"; content:"|10|neoinvestmentllp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitrousantispy.com (trojan)"; content:"|0e|nitrousantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nokiaicq.ru (exploits)"; content:"|08|nokiaicq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup norton-protection.cn (malware)"; content:"|11|norton-protection|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notsex.info (malware)"; content:"|06|notsex|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obsque.info (rogue)"; content:"|06|obsque|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ollinterssecs.com (rogue)"; content:"|0d|ollinterssecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omgyaksaresohot.com (zbot)"; content:"|0f|omgyaksaresohot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openoffice-full.info (rogue)"; content:"|0f|openoffice-full|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otimla.cn (fraud_scam)"; content:"|06|otimla|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup own-shoes.com (fraud_scam)"; content:"|09|own-shoes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup own-shoes.net (fraud_scam)"; content:"|09|own-shoes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pante.info (rogue)"; content:"|05|pante|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pasio.info (rogue)"; content:"|05|pasio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymate-solutions.org (fraud_scam)"; content:"|11|paymate-solutions|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pccleantotal.com (trojan)"; content:"|0c|pccleantotal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalguard2009.com (rogue)"; content:"|11|personalguard2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phaselistravel.com (fraud_scam)"; content:"|0e|phaselistravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoenix-groupmain.cn (fraud_scam)"; content:"|11|phoenix-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsmartbody.com.cn (fraud_scam)"; content:"|0d|pillsmartbody|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premier-groupinc.com (fraud_scam)"; content:"|10|premier-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premier-groupnet.cc (fraud_scam)"; content:"|10|premier-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup printservice.kiev.ua (backdoor)"; content:"|0c|printservice|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectpconline.com (trojan)"; content:"|0f|protectpconline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psp-shop.com (fraud_scam)"; content:"|08|psp-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiiiq.ru (exploits)"; content:"|05|qiiiq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruitmoranna.com (fraud_scam)"; content:"|0e|recruitmoranna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ribcot.com (malware)"; content:"|06|ribcot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryvigyys.cn (fraud_scam)"; content:"|08|ryvigyys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saturn-groupco.cc (fraud_scam)"; content:"|0e|saturn-groupco|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmydesktop.com (rogue)"; content:"|0d|scanmydesktop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanmylaptop.com (rogue)"; content:"|0c|scanmylaptop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityadjust.com (trojan)"; content:"|0e|securityadjust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityannounce.com (trojan)"; content:"|10|securityannounce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitymodify.com (trojan)"; content:"|0e|securitymodify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitythreatalert.com (trojan)"; content:"|13|securitythreatalert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sfanyy.cn (fraud_scam)"; content:"|06|sfanyy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoes-supplier.com (fraud_scam)"; content:"|0e|shoes-supplier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-trading.org (fraud_scam)"; content:"|0d|smart-trading|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakers-buy.com (fraud_scam)"; content:"|0c|sneakers-buy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakers-mall.com (fraud_scam)"; content:"|0d|sneakers-mall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakers-sale.com (fraud_scam)"; content:"|0d|sneakers-sale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakers-sales.com (fraud_scam)"; content:"|0e|sneakers-sales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakers-stock.com (fraud_scam)"; content:"|0e|sneakers-stock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spinge.info (rogue)"; content:"|06|spinge|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spynet.shipit.me.uk (malware)"; content:"|06|spynet|06|shipit|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star-groupinc.net (fraud_scam)"; content:"|0d|star-groupinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star-groupsvc.cn (fraud_scam)"; content:"|0d|star-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star-groupsvc.com (fraud_scam)"; content:"|0d|star-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stargroupinc.cn (fraud_scam)"; content:"|0c|stargroupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats.adversting-media.com (exploits)"; content:"|05|stats|10|adversting-media|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup styleicq.ru (exploits)"; content:"|08|styleicq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suivez.info (rogue)"; content:"|06|suivez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summit-groupinc.cc (fraud_scam)"; content:"|0f|summit-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summit-groupinc.cn (fraud_scam)"; content:"|0f|summit-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemannounce.com (trojan)"; content:"|0e|systemannounce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-age.ru (exploits)"; content:"|05|t-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theupdatetest.com (trojan)"; content:"|0d|theupdatetest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup threatalertonline.com (trojan)"; content:"|11|threatalertonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup til1tlli.com (threat)"; content:"|08|til1tlli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tll1tlli.net (threat)"; content:"|08|tll1tlli|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tm-stat.com (exploits)"; content:"|07|tm-stat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tractors-agiaffairs-ltd.com (fraud_scam)"; content:"|17|tractors-agiaffairs-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradefastsecure.com (rogue)"; content:"|0f|tradefastsecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twelfth-banners.info (exploits)"; content:"|0f|twelfth-banners|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twelfth-blocks.info (exploits)"; content:"|0e|twelfth-blocks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twelfth-counters.info (exploits)"; content:"|10|twelfth-counters|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimaguard.com (malware)"; content:"|0b|ultimaguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utc-shop.net (malware)"; content:"|08|utc-shop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veldun.info (rogue)"; content:"|06|veldun|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipreactor.cn (scam)"; content:"|0a|vipreactor|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vision-groupinc.cc (fraud_scam)"; content:"|0f|vision-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vision-groupsvc.cn (fraud_scam)"; content:"|0f|vision-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web1movies.cn (trojan)"; content:"|0a|web1movies|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websecure32.com (malwareurl.com)"; content:"|0b|websecure32|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westend-payments.net (fraud_scam)"; content:"|10|westend-payments|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsguardsuite.com (rogue)"; content:"|11|windowsguardsuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowssystemsuite.com (rogue)"; content:"|12|windowssystemsuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wow-systers.com (malware)"; content:"|0b|wow-systers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfire-hot-pornxx.info (malware)"; content:"|10|xfire-hot-pornxx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyg1qe.eu (zbot)"; content:"|06|xyg1qe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yougoingnow.com (malware)"; content:"|0b|yougoingnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourguardonline.com (trojan)"; content:"|0f|yourguardonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zemla-50.info (malware)"; content:"|08|zemla-50|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zroppy.cn (fraud_scam)"; content:"|06|zroppy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3ba3h.cn (malware)"; content:"|05|3ba3h|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5job5.cn (malware)"; content:"|05|5job5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2dg2o.cn (malware)"; content:"|06|a2dg2o|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a6ga6.cn (malware)"; content:"|05|a6ga6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup achepizzeria.com (malware)"; content:"|0c|achepizzeria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actualmultimedia.com (malware)"; content:"|10|actualmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admindatacenter.org (malware)"; content:"|0f|admindatacenter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alssayer.ws (malware)"; content:"|08|alssayer|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anobalukager.com (scareware)"; content:"|0c|anobalukager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anobhalukager.com (scareware)"; content:"|0d|anobhalukager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarescanner-7.com (malware)"; content:"|14|antimalwarescanner-7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiwebcorp.com (malware)"; content:"|0b|antiwebcorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avidentify.com (scareware)"; content:"|0a|avidentify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantimalware08.com (malware)"; content:"|11|bestantimalware08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmovieutilites.net (malware)"; content:"|11|bestmovieutilites|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfg-7340.com (malware)"; content:"|08|bfg-7340|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackmelisa.com (malware)"; content:"|0b|blackmelisa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brollton.com (malware)"; content:"|08|brollton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buhafertadosag.com (scareware)"; content:"|0e|buhafertadosag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buleropihdertan.com (malware)"; content:"|0f|buleropihdertan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c-o-c-o.in (malware)"; content:"|07|c-o-c-o|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certovalionas.com (scareware)"; content:"|0d|certovalionas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubhuistrem01.nl (malware)"; content:"|0e|clubhuistrem01|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup come-face-the-truth.com (scam)"; content:"|13|come-face-the-truth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-protection-1.com (malware)"; content:"|15|computer-protection-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comzonedom.ru (malware)"; content:"|0a|comzonedom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cool4tube.com (malware)"; content:"|09|cool4tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d5g5l.cn (malware)"; content:"|05|d5g5l|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d5hsr.cn (malware)"; content:"|05|d5hsr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dabertugabusrav.com (malware)"; content:"|0f|dabertugabusrav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desaqurtung.com (malware)"; content:"|0b|desaqurtung|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup didasinike.ro (malware)"; content:"|0a|didasinike|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalmultimediaservice.com (malware)"; content:"|18|digitalmultimediaservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dingsmedia.net (malware)"; content:"|0a|dingsmedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dino-war1722.com (malware)"; content:"|0c|dino-war1722|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dis.unipv.it (malware)"; content:"|03|dis|05|unipv|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotmarket.biz (malware)"; content:"|09|dotmarket|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr4.com (scareware)"; content:"|0c|downloadavr4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsg3aeg.cn (malware)"; content:"|07|dsg3aeg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e1ag1j.cn (malware)"; content:"|06|e1ag1j|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1e.co.uk (phish)"; content:"|08|easder1e|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1q.co.uk (phish)"; content:"|08|easder1q|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1q.me.uk (phish)"; content:"|08|easder1q|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eg2thg.cn (malware)"; content:"|06|eg2thg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekivoonly.com (malware)"; content:"|09|ekivoonly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup energiagrowthstrategies.com (malware)"; content:"|17|energiagrowthstrategies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erorr.net (malware)"; content:"|05|erorr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertu6nagertos.com (scareware)"; content:"|0d|ertu6nagertos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertugaskedumil.com (scareware)"; content:"|0e|ertugaskedumil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erubamerkafdolo.com (malware)"; content:"|0f|erubamerkafdolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscansearch.net (scareware)"; content:"|0e|fastscansearch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedostalonkah.com (scareware)"; content:"|0d|fedostalonkah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffffefdl.co.uk (fastflux)"; content:"|08|ffffefdl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffffefvl.co.uk (fastflux)"; content:"|08|ffffefvl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffffexdl.co.uk (fastflux)"; content:"|08|ffffexdl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffffexij.co.uk (fastflux)"; content:"|08|ffffexij|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fg4yjv.cn (malware)"; content:"|06|fg4yjv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesplugindirect.com (malware)"; content:"|11|filesplugindirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-adult-sites.net (malware)"; content:"|10|free-adult-sites|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshflashplugin.com (malware)"; content:"|10|freshflashplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friends.photo-facebook.org (malware)"; content:"|07|friends|0e|photo-facebook|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftahulabedaso.com (scareware)"; content:"|0d|ftahulabedaso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g4k4h.cn (malware)"; content:"|05|g4k4h|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gae1hasdf.cn (malware)"; content:"|09|gae1hasdf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gedmediaplugin.com (malware)"; content:"|0e|gedmediaplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globaltoolsmedia.com (malware)"; content:"|10|globaltoolsmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goople.biz (malware)"; content:"|06|goople|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goxtrascan.com (scareware)"; content:"|0a|goxtrascan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hamzabx1.biz (malware)"; content:"|08|hamzabx1|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup having-fun2.cn (malware)"; content:"|0b|having-fun2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hibernawar.com (malware)"; content:"|0a|hibernawar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homut1.cn (malware)"; content:"|06|homut1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ij1tli.com (phish)"; content:"|06|ij1tli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iniegox.cn (scareware)"; content:"|07|iniegox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javascrlpt.com (malware)"; content:"|0a|javascrlpt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jikoladrem.com (malware)"; content:"|0a|jikoladrem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julionejurmon.com (scareware)"; content:"|0d|julionejurmon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keysymol.com (malware)"; content:"|08|keysymol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klirok.net (malware)"; content:"|06|klirok|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup konitorswabure.com (malware)"; content:"|0e|konitorswabure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lchiil1.net (malware)"; content:"|07|lchiil1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lereftu.net (malware)"; content:"|07|lereftu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lersolamaderg.com (scareware)"; content:"|0d|lersolamaderg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lersolamgaderg.com (scareware)"; content:"|0e|lersolamgaderg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkertaguboert.com (malware)"; content:"|0f|linkertaguboert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ll1tlii.com (fastflux)"; content:"|07|ll1tlii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllliok.me.uk (phish)"; content:"|07|lllliok|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llllior.co.uk (phish)"; content:"|07|llllior|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllliou.co.uk (phish)"; content:"|07|lllliou|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllliow.co.uk (phish)"; content:"|07|lllliow|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopastionertu.com (scareware)"; content:"|0d|lopastionertu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mafiavirtual.net (malware)"; content:"|0c|mafiavirtual|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minimultimedia.com (malware)"; content:"|0e|minimultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modesftp.eu (phish)"; content:"|08|modesftp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movietoolsstorage.com (malware)"; content:"|11|movietoolsstorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieutilitesworld.net (malware)"; content:"|12|movieutilitesworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncccnnnc.cn (malware)"; content:"|08|ncccnnnc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nebrafsofertu.com (scareware)"; content:"|0d|nebrafsofertu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nexinsinc.com (malware)"; content:"|09|nexinsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niggs.net (malware)"; content:"|05|niggs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nukaszqz.net (malware)"; content:"|08|nukaszqz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obuleskinrodab.com (scareware)"; content:"|0e|obuleskinrodab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofaderhpabewuit.com (malware)"; content:"|0f|ofaderhpabewuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okaveanubares.com (malware)"; content:"|0d|okaveanubares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oscaviolaner.com (scareware)"; content:"|0c|oscaviolaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pafersbasedos.com (scareware)"; content:"|0d|pafersbasedos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panoramapics.com (malware)"; content:"|0c|panoramapics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcbossguard.com (malware)"; content:"|0b|pcbossguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perenils.cn (malware)"; content:"|08|perenils|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfg-inc.eu (malware)"; content:"|07|pfg-inc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photo-facebook.net (malware)"; content:"|0e|photo-facebook|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntake.org (malware)"; content:"|08|porntake|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powermig.ru (malware)"; content:"|08|powermig|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privetmedved.cn (malware)"; content:"|0c|privetmedved|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quierosalud.com (malware)"; content:"|0b|quierosalud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racder1c.net (AvalancheBotnet)"; content:"|08|racder1c|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup racder1x.com (AvalancheBotnet)"; content:"|08|racder1x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raeder1f.net (AvalancheBotnet)"; content:"|08|raeder1f|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rarder1g.com (AvalancheBotnet)"; content:"|08|rarder1g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raxsder1.net (AvalancheBotnet)"; content:"|08|raxsder1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmediaplayerdirect.com (malware)"; content:"|15|realmediaplayerdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmultitool.com (malware)"; content:"|0d|realmultitool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reffea1.co.uk (fast_flux)"; content:"|07|reffea1|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regautorepair.com (malware)"; content:"|0d|regautorepair|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riaasoftware.cn (malware)"; content:"|0c|riaasoftware|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtugamer5tobes.com (scareware)"; content:"|0e|rtugamer5tobes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtugamertobes.com (scareware)"; content:"|0d|rtugamertobes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rzasder1.com (AvalancheBotnet)"; content:"|08|rzasder1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.1-db.org (malware)"; content:"|06|secure|04|1-db|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycentr.com (scareware)"; content:"|0d|securitycentr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shuretrobaniso.com (scareware)"; content:"|0e|shuretrobaniso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siftozzillaa.cn (malware)"; content:"|0c|siftozzillaa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skinswhoot.com (malware)"; content:"|0a|skinswhoot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starmultimediagroup.com (malware)"; content:"|13|starmultimediagroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storageutilities.net (malware)"; content:"|10|storageutilities|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t1fliil.tc (AvalancheBotnet)"; content:"|07|t1fliil|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdscounter.cn (malware)"; content:"|0a|tdscounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techhomeservice.net (malware)"; content:"|0f|techhomeservice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technologyplayer.net (malware)"; content:"|10|technologyplayer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tertunwavogav.com (scareware)"; content:"|0d|tertunwavogav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theidealtool.com (malware)"; content:"|0c|theidealtool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-antispyware-scan0.com (malware)"; content:"|15|top-antispyware-scan0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-antispyware-scan9.com (malware)"; content:"|15|top-antispyware-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traf.mobi (malware)"; content:"|04|traf|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treav.com (malware)"; content:"|05|treav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustsoldier.com (scareware)"; content:"|0c|trustsoldier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsabunerkadosa.com (scareware)"; content:"|0e|tsabunerkadosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsarbunerkadosa.com (scareware)"; content:"|0f|tsarbunerkadosa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wa.co.uk (malware)"; content:"|06|ttt1wa|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wa.eu (malware)"; content:"|06|ttt1wa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1we.co.uk (fast_flux)"; content:"|06|ttt1we|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wp.co.uk (malware)"; content:"|06|ttt1wp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wp.eu (fast_flux)"; content:"|06|ttt1wp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1ww.co.uk (malware)"; content:"|06|ttt1ww|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wy.co.uk (malware)"; content:"|06|ttt1wy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt1wz.co.uk (fast_flux)"; content:"|06|ttt1wz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typewordxs.com (malware)"; content:"|0a|typewordxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uliopewrdanogad.com (scareware)"; content:"|0f|uliopewrdanogad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utka3merdosubor.com (scareware)"; content:"|0f|utka3merdosubor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utkamerdosubor.com (scareware)"; content:"|0e|utkamerdosubor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utorganedoskaw.com (scareware)"; content:"|0e|utorganedoskaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utorgtanedoskaw.com (scareware)"; content:"|0f|utorgtanedoskaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uvgadferbotario.com (malware)"; content:"|0f|uvgadferbotario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewnowfast.com (malware)"; content:"|0b|viewnowfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuilerdomegase.com (scareware)"; content:"|0e|vuilerdomegase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vulertagulermos.com (scareware)"; content:"|0f|vulertagulermos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvverfd.co.uk (fastflux)"; content:"|07|vvverfd|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weedies.net (malware)"; content:"|07|weedies|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weragumasekasuke.com (scareware)"; content:"|10|weragumasekasuke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup werynaherdobas.com (scareware)"; content:"|0e|werynaherdobas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows7-catalog.cn (malware)"; content:"|10|windows7-catalog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwantispyware-1.com (malware)"; content:"|10|wwwantispyware-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xinx02.cn (malware)"; content:"|06|xinx02|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiny69.cn (malware)"; content:"|06|xiny69|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxdessert.name (malware)"; content:"|0a|xxxdessert|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrd.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrd|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyre.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyre|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrf.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrg.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrj.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrj|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrk.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrl.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrm.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrm|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyro.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyro|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrq.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrq|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrr.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrr|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrs.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrs|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyru.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyru|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrv.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrv|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1yyrx.co.uk (AvalancheBotnet)"; content:"|08|yyy1yyrx|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoopzip.exofire.net (malware)"; content:"|07|zoopzip|07|exofire|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0pcscanner.com (malware)"; content:"|0a|0pcscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanced-virus-remover-2009.com (malware)"; content:"|1b|advanced-virus-remover-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanced-virusremover-2009.com (malware)"; content:"|1a|advanced-virusremover-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancedvirusremover-2009.com (malware)"; content:"|19|advancedvirusremover-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adversting-media.com (malware)"; content:"|10|adversting-media|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alert-pay.biz (malware)"; content:"|09|alert-pay|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alt-groupco.net (malware)"; content:"|0b|alt-groupco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an90fwq9.biz (malware)"; content:"|08|an90fwq9|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live-6.com (rogue)"; content:"|10|antivirus-live-6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online-2.com (rogue)"; content:"|12|antivirus-online-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online-5.com (rogue)"; content:"|12|antivirus-online-5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cert-db.com (malware)"; content:"|07|cert-db|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cert-db.net (malware)"; content:"|07|cert-db|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cert-db.org (malware)"; content:"|07|cert-db|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cert-services.org (malware)"; content:"|0d|cert-services|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cert1.org (malware)"; content:"|05|cert1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certificates-db.com (malware)"; content:"|0f|certificates-db|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certificates-db.net (malware)"; content:"|0f|certificates-db|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certificates-db.org (malware)"; content:"|0f|certificates-db|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defend-syszone.com (malware)"; content:"|0e|defend-syszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defend-syszone.net (malware)"; content:"|0e|defend-syszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendsys-zone.com (malware)"; content:"|0e|defendsys-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendsys-zone.net (malware)"; content:"|0e|defendsys-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendsyszone.com (malware)"; content:"|0d|defendsyszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendsyszone.net (malware)"; content:"|0d|defendsyszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dessaxqaa.co.uk (malware)"; content:"|09|dessaxqaa|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dessaxzaa.me.uk (malware)"; content:"|09|dessaxzaa|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dessaxzaq.co.uk (malware)"; content:"|09|dessaxzaq|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dessaxzaq.me.uk (malware)"; content:"|09|dessaxzaq|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digi-1.net (malware)"; content:"|06|digi-1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digi-1.org (malware)"; content:"|06|digi-1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalsecuritymonitor.com (rogue)"; content:"|15|globalsecuritymonitor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godoerscan.com (malware)"; content:"|0a|godoerscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guard-syszone.com (malware)"; content:"|0d|guard-syszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guard-syszone.net (malware)"; content:"|0d|guard-syszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsys-zone.com (malware)"; content:"|0d|guardsys-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsys-zone.net (malware)"; content:"|0d|guardsys-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsyszone.com (malware)"; content:"|0c|guardsyszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsyszone.net (malware)"; content:"|0c|guardsyszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardvac.com (malware)"; content:"|08|guardvac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardzone-sys.com (malware)"; content:"|0d|guardzone-sys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardzone-sys.net (malware)"; content:"|0d|guardzone-sys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijepiyq.cn (malware)"; content:"|07|ijepiyq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijesiam.cn (malware)"; content:"|07|ijesiam|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijuebka.cn (malware)"; content:"|07|ijuebka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijyadpi.cn (malware)"; content:"|07|ijyadpi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijyoxri.cn (malware)"; content:"|07|ijyoxri|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikaocy.cn (malware)"; content:"|06|ikaocy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikayvo.cn (malware)"; content:"|06|ikayvo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikeuqe.cn (malware)"; content:"|06|ikeuqe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikeysi.cn (malware)"; content:"|06|ikeysi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikioda.cn (malware)"; content:"|06|ikioda|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuyxc.com (harmful)"; content:"|05|iuyxc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jestuab.cn (malware)"; content:"|07|jestuab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jewymvi.cn (malware)"; content:"|07|jewymvi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jidkeyt.cn (malware)"; content:"|07|jidkeyt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiscean.cn (malware)"; content:"|07|jiscean|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiwhopa.cn (malware)"; content:"|07|jiwhopa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jypfeov.cn (malware)"; content:"|07|jypfeov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jytsit.cn (malware)"; content:"|06|jytsit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyvalew.cn (malware)"; content:"|07|jyvalew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jywamfe.cn (malware)"; content:"|07|jywamfe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jywqiva.cn (malware)"; content:"|07|jywqiva|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jywuxiv.cn (malware)"; content:"|07|jywuxiv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyxipat.cn (malware)"; content:"|07|jyxipat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lxwar.com (harmful)"; content:"|05|lxwar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111saq.eu (malware)"; content:"|07|n111saq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okkkikkl.eu (malware)"; content:"|08|okkkikkl|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okkkilkf.eu (malware)"; content:"|08|okkkilkf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okktylkf.eu (malware)"; content:"|08|okktylkf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcdigitalguard.com (malware)"; content:"|0e|pcdigitalguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprotectdirect.com (rogue)"; content:"|0f|pcprotectdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsafetyguide.com (malware)"; content:"|0d|pcsafetyguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcscoutinc.com (malware)"; content:"|0a|pcscoutinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcscoutlab.com (rogue)"; content:"|0a|pcscoutlab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsecuritycorp.com (malware)"; content:"|0e|pcsecuritycorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pencuri.ucoz.com (malware)"; content:"|07|pencuri|04|ucoz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-guard-2009.com (rogue)"; content:"|13|personal-guard-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pictureviewes.com (malware)"; content:"|0d|pictureviewes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plcscanner.com (malware)"; content:"|0a|plcscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pricecheckjapan.com (malware)"; content:"|0f|pricecheckjapan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-syszone.net (malware)"; content:"|0f|protect-syszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionlabs.com (rogue)"; content:"|0e|protectionlabs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectsys-zone.net (malware)"; content:"|0f|protectsys-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectsyszone.com (malware)"; content:"|0e|protectsyszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectsyszone.net (malware)"; content:"|0e|protectsyszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-againx.com (malware)"; content:"|14|protectyourpc-againx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-fastsx.com (malware)"; content:"|14|protectyourpc-fastsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-nowx.com (malware)"; content:"|12|protectyourpc-nowx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-todayx.com (malware)"; content:"|14|protectyourpc-todayx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psmanaus.com.br (malware)"; content:"|08|psmanaus|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qadrock.com (malware)"; content:"|07|qadrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrref1okz.eu (malware)"; content:"|09|rrref1okz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-admins.net (malware)"; content:"|0d|secure-admins|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-admins.org (malware)"; content:"|0d|secure-admins|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-antivirus.net (rogue)"; content:"|10|secure-antivirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-syszone.com (malware)"; content:"|0e|secure-syszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-syszone.net (malware)"; content:"|0e|secure-syszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.secureorder-3.com (malware)"; content:"|06|secure|0d|secureorder-3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureorder-3.com (malware)"; content:"|0d|secureorder-3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securesys-zone.com (malware)"; content:"|0e|securesys-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securesys-zone.net (malware)"; content:"|0e|securesys-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securesyszone.com (malware)"; content:"|0d|securesyszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securesyszone.net (malware)"; content:"|0d|securesyszone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityearth.cn (malware)"; content:"|0d|securityearth|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftwarewebsite.com (rogue)"; content:"|17|securitysoftwarewebsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytestinternetdirect.com (rogue)"; content:"|1a|securitytestinternetdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssapee.com (harmful)"; content:"|06|ssapee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thealertsecurity.com (rogue)"; content:"|10|thealertsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tintasecuador.com (malware)"; content:"|0d|tintasecuador|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-antispyware-scan8.com (rogue)"; content:"|15|top-antispyware-scan8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujihkoi.eu (malware)"; content:"|07|ujihkoi|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-pc-protection2.com (malware)"; content:"|13|your-pc-protection2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantivirus-4.com (rogue)"; content:"|0f|yourantivirus-4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 00ewr00m.info (malware)"; content:"|08|00ewr00m|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 06w.ru (malware)"; content:"|03|06w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-adm.com (malware)"; content:"|05|1-adm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-adm.net (malware)"; content:"|05|1-adm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-adm.org (malware)"; content:"|05|1-adm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-admin.org (malware)"; content:"|07|1-admin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-central.org (malware)"; content:"|09|1-central|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-cert.org (malware)"; content:"|06|1-cert|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-data.org (malware)"; content:"|06|1-data|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-db.org (malware)"; content:"|04|1-db|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-upd.com (malware)"; content:"|05|1-upd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-upd.net (malware)"; content:"|05|1-upd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1-upd.org (malware)"; content:"|05|1-upd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1data-upd.com (malware)"; content:"|09|1data-upd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1data-upd.org (malware)"; content:"|09|1data-upd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ssl-certs.org (malware)"; content:"|0a|1ssl-certs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ssl-network.org (malware)"; content:"|0c|1ssl-network|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abumaso3thkamid.com (malware)"; content:"|0f|abumaso3thkamid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adm-1.net (malware)"; content:"|05|adm-1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adm-1.org (malware)"; content:"|05|adm-1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-data.org (malware)"; content:"|0a|admin-data|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-db.org (malware)"; content:"|08|admin-db|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-services1.com (malware)"; content:"|0f|admin-services1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-services1.net (malware)"; content:"|0f|admin-services1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-services1.org (malware)"; content:"|0f|admin-services1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-systems.org (malware)"; content:"|0d|admin-systems|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altgroupco.cn (malware)"; content:"|0a|altgroupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amdssl2010.xpg.com.br (malware)"; content:"|0a|amdssl2010|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anzantra.se (malware)"; content:"|08|anzantra|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup applestore2.cn (malware)"; content:"|0b|applestore2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquaplant-chile.cl (malware)"; content:"|0f|aquaplant-chile|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asbro.info (malware)"; content:"|05|asbro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auditcashing.com (malware)"; content:"|0c|auditcashing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-check-now.com (malware)"; content:"|0c|av-check-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axdrock.com (malware)"; content:"|07|axdrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babyu.co.kr (malware)"; content:"|05|babyu|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedrid.info (malware)"; content:"|06|bedrid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellangora.fr (malware)"; content:"|0a|bellangora|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antimalware-1.com (rogue)"; content:"|12|best-antimalware-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antispyware-11.com (rogue)"; content:"|13|best-antispyware-11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scan-pc.net (malware)"; content:"|0c|best-scan-pc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmalwareinternetscanv4.com (blacklist)"; content:"|19|bestmalwareinternetscanv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bettev.info (malware)"; content:"|06|bettev|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billmenowx.com (malware)"; content:"|0a|billmenowx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biosecurityservices.com (rogue)"; content:"|13|biosecurityservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdiedanwg.tripod.com (malware)"; content:"|0b|birdiedanwg|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blanshinblansh.net (malware)"; content:"|0e|blanshinblansh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brain-groupsvc.cn (malware)"; content:"|0e|brain-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brain-groupsvc.com (malware)"; content:"|0e|brain-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup braingroupmain.cn (malware)"; content:"|0e|braingroupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brguenzelsf.tripod.com (malware)"; content:"|0b|brguenzelsf|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulerkoseddgasko.com (malware)"; content:"|10|bulerkoseddgasko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessrest.cn (malware)"; content:"|0c|businessrest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup central-updates.org (malware)"; content:"|0f|central-updates|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charlottegaspard.net (harmful)"; content:"|10|charlottegaspard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheaplcom.com (malware)"; content:"|09|cheaplcom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkmalware9.com (rogue)"; content:"|0d|checkmalware9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chicagofc.co.kr (malware)"; content:"|09|chicagofc|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciasoftwares.com (malware)"; content:"|0c|ciasoftwares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinquentac.dominiotemporario.com (malware)"; content:"|0a|cinquentac|11|dominiotemporario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanvirusesonline.info (malware)"; content:"|12|cleanvirusesonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-protection-2.com (malware)"; content:"|15|computer-protection-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-protection-7.com (malware)"; content:"|15|computer-protection-7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolstats1.net (malware)"; content:"|0a|coolstats1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2792.scanyourpc-onlinex.com (malware)"; content:"|08|core2792|12|scanyourpc-onlinex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crucism.com (malware)"; content:"|07|crucism|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curah.net (malware)"; content:"|05|curah|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datatrustprotect.com (rogue)"; content:"|10|datatrustprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup db-1.org (malware)"; content:"|04|db-1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverup.net (malware)"; content:"|0a|discoverup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkinshoot.com (malware)"; content:"|09|dkinshoot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolet.info (malware)"; content:"|05|dolet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr6.com (malware)"; content:"|0c|downloadavr6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dubnahome.ru (malware)"; content:"|09|dubnahome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electronicwebbilling.com (malware)"; content:"|14|electronicwebbilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elektronservice.net (malware)"; content:"|0f|elektronservice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eratile.info (malware)"; content:"|07|eratile|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertanue5skayert.com (malware)"; content:"|0f|ertanue5skayert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezymart.com.au (malware)"; content:"|07|ezymart|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f5rrtnti.in (malware)"; content:"|08|f5rrtnti|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttracklab.com (malware)"; content:"|0c|fasttracklab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fedar.info (malware)"; content:"|05|fedar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feelife.ru (malware)"; content:"|07|feelife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feliciagirl.cn (malware)"; content:"|0b|feliciagirl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup first-update.com (malware)"; content:"|0c|first-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup first-update.org (malware)"; content:"|0c|first-update|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futu.co.kr (malware)"; content:"|04|futu|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fypewords.com (malware)"; content:"|09|fypewords|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gh3pop0.info (malware)"; content:"|07|gh3pop0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gicke.info (malware)"; content:"|05|gicke|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giffarine.co.th (malware)"; content:"|09|giffarine|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokzed.cn (malware)"; content:"|06|gokzed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golary.cn (malware)"; content:"|06|golary|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopickscan.com (malware)"; content:"|0a|gopickscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorazyn.cn (malware)"; content:"|07|gorazyn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotophair.co.kr (malware)"; content:"|09|gotophair|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatinspect.com (malware)"; content:"|0c|greatinspect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gswheel.com (malware)"; content:"|07|gswheel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardzonesys.com (malware)"; content:"|0c|guardzonesys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h8ae8.cn (malware)"; content:"|05|h8ae8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hahdyti.cn (malware)"; content:"|07|hahdyti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hilloa.info (malware)"; content:"|06|hilloa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiqtacy.cn (malware)"; content:"|07|hiqtacy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup historycontext.cn (malware)"; content:"|0e|historycontext|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostmann-steinberg.ru (malware)"; content:"|12|hostmann-steinberg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydraumatec.com (malware)"; content:"|0b|hydraumatec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icepot.cn (malware)"; content:"|06|icepot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idirectwww.com (malware)"; content:"|0a|idirectwww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idoape.cn (malware)"; content:"|06|idoape|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifueme.cn (malware)"; content:"|06|ifueme|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igakuot.cn (malware)"; content:"|07|igakuot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igoudix.cn (malware)"; content:"|07|igoudix|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igycoat.cn (malware)"; content:"|07|igycoat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihaerxi.cn (malware)"; content:"|07|ihaerxi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihoekag.cn (malware)"; content:"|07|ihoekag|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihogedi.cn (malware)"; content:"|07|ihogedi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihouvi.cn (malware)"; content:"|06|ihouvi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihuere.cn (malware)"; content:"|06|ihuere|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihuqoyr.cn (malware)"; content:"|07|ihuqoyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijaheuw.cn (malware)"; content:"|07|ijaheuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijakony.cn (malware)"; content:"|07|ijakony|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijazofy.cn (malware)"; content:"|07|ijazofy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijeife.cn (malware)"; content:"|06|ijeife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijelodi.cn (malware)"; content:"|07|ijelodi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikuaxge.cn (malware)"; content:"|07|ikuaxge|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ileufby.cn (malware)"; content:"|07|ileufby|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilipyw.cn (malware)"; content:"|06|ilipyw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iluise.cn (malware)"; content:"|06|iluise|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilyocij.cn (malware)"; content:"|07|ilyocij|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilyqous.cn (malware)"; content:"|07|ilyqous|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inagyve.cn (malware)"; content:"|07|inagyve|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineigta.cn (malware)"; content:"|07|ineigta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inejayf.cn (malware)"; content:"|07|inejayf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineoky.cn (malware)"; content:"|06|ineoky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineuho.cn (malware)"; content:"|06|ineuho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iniecyb.cn (malware)"; content:"|07|iniecyb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iniohi.cn (malware)"; content:"|06|iniohi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iniwuv.cn (malware)"; content:"|06|iniwuv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inyelu.cn (malware)"; content:"|06|inyelu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inyxode.cn (malware)"; content:"|07|inyxode|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipaliky.cn (malware)"; content:"|07|ipaliky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipaugli.cn (malware)"; content:"|07|ipaugli|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipemuw.cn (malware)"; content:"|06|ipemuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipisuw.cn (malware)"; content:"|06|ipisuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqaotfy.cn (malware)"; content:"|07|iqaotfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqevun.cn (malware)"; content:"|06|iqevun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqewano.cn (malware)"; content:"|07|iqewano|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqoakpi.cn (malware)"; content:"|07|iqoakpi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqywauf.cn (malware)"; content:"|07|iqywauf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iraqicu.cn (malware)"; content:"|07|iraqicu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ireigma.cn (malware)"; content:"|07|ireigma|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ireoze.cn (malware)"; content:"|06|ireoze|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irexaym.cn (malware)"; content:"|07|irexaym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irileto.cn (malware)"; content:"|07|irileto|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iriumjo.cn (malware)"; content:"|07|iriumjo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irozup.cn (malware)"; content:"|06|irozup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isepihy.cn (malware)"; content:"|07|isepihy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isyoti.cn (malware)"; content:"|06|isyoti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itevyx.cn (malware)"; content:"|06|itevyx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ituyxe.cn (malware)"; content:"|06|ituyxe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivehod.cn (malware)"; content:"|06|ivehod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iveigyr.cn (malware)"; content:"|07|iveigyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivobudy.cn (malware)"; content:"|07|ivobudy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivofah.cn (malware)"; content:"|06|ivofah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivuxiaq.cn (malware)"; content:"|07|ivuxiaq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivuywu.cn (malware)"; content:"|06|ivuywu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwagily.cn (malware)"; content:"|07|iwagily|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwant-x.com (malware)"; content:"|07|iwant-x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwaunom.cn (malware)"; content:"|07|iwaunom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwipyje.cn (malware)"; content:"|07|iwipyje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwuoxo.cn (malware)"; content:"|06|iwuoxo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwuveoc.cn (malware)"; content:"|07|iwuveoc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwyhuda.cn (malware)"; content:"|07|iwyhuda|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixejos.cn (malware)"; content:"|06|ixejos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixohiyr.cn (malware)"; content:"|07|ixohiyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixouwes.cn (malware)"; content:"|07|ixouwes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixozure.cn (malware)"; content:"|07|ixozure|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixuzywe.cn (malware)"; content:"|07|ixuzywe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup izaheis.cn (malware)"; content:"|07|izaheis|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup izaywur.cn (malware)"; content:"|07|izaywur|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup izesoz.cn (malware)"; content:"|06|izesoz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabdup.cn (malware)"; content:"|06|jabdup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jasfezu.cn (malware)"; content:"|07|jasfezu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jatokfi.cn (malware)"; content:"|07|jatokfi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jegaqe.cn (malware)"; content:"|06|jegaqe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jemjouw.cn (malware)"; content:"|07|jemjouw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jenpyoj.cn (malware)"; content:"|07|jenpyoj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jizkulo.cn (malware)"; content:"|07|jizkulo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jrizoxom.cn (malware)"; content:"|08|jrizoxom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jugawa.cn (malware)"; content:"|06|jugawa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julxyaf.cn (malware)"; content:"|07|julxyaf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jutyja.cn (malware)"; content:"|06|jutyja|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juwciol.cn (malware)"; content:"|07|juwciol|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juzsaon.cn (malware)"; content:"|07|juzsaon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jychape.cn (malware)"; content:"|07|jychape|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyfugo.cn (malware)"; content:"|06|jyfugo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jygoto.cn (malware)"; content:"|06|jygoto|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jymavco.cn (malware)"; content:"|07|jymavco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jymzowi.cn (malware)"; content:"|07|jymzowi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jynoqi.cn (malware)"; content:"|06|jynoqi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k23cc-o-fenomeno.50webs.com (malware)"; content:"|10|k23cc-o-fenomeno|06|50webs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadefpu.cn (malware)"; content:"|07|kadefpu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadeni.cn (malware)"; content:"|06|kadeni|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaehwa.es.kr (malware)"; content:"|06|kaehwa|02|es|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalepod.cn (malware)"; content:"|07|kalepod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kb27.co.kr (malware)"; content:"|04|kb27|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidalatube.netii.net (malware)"; content:"|0a|kidalatube|05|netii|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kms75.or.kr (malware)"; content:"|05|kms75|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knenote.com (malware)"; content:"|07|knenote|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastsecurity.com (malware)"; content:"|0c|lastsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letsworknowx.com (malware)"; content:"|0c|letsworknowx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leungting.com (malware)"; content:"|09|leungting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leysymbol.com (malware)"; content:"|09|leysymbol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailserver-updates.com (malware)"; content:"|12|mailserver-updates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailserver-updates.net (malware)"; content:"|12|mailserver-updates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailserver-updates.org (malware)"; content:"|12|mailserver-updates|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media-news2.cn (malware)"; content:"|0b|media-news2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mednetsafety.com (malware)"; content:"|0c|mednetsafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meganetop.co.jp (malware)"; content:"|09|meganetop|02|co|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meidu.soit.com.cn (malware)"; content:"|05|meidu|04|soit|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg1b.info (malware)"; content:"|04|mg1b|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mikyaku.jp (malware)"; content:"|07|mikyaku|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miomatrimonio.com (malware)"; content:"|0d|miomatrimonio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmsfoundsystem.ru (malware)"; content:"|0e|mmsfoundsystem|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobled.info (malware)"; content:"|06|mobled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moont.info (malware)"; content:"|05|moont|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moshiz.cn (malware)"; content:"|06|moshiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieinthepark.ca (malware)"; content:"|0e|movieinthepark|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecl.com (malware)"; content:"|06|mysecl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n34.biz (malware)"; content:"|03|n34|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netsecuritycode.com (rogue)"; content:"|0f|netsecuritycode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nixserver-systems.org (malware)"; content:"|11|nixserver-systems|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuzogbf.cn (malware)"; content:"|07|nuzogbf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvidia-groupnet.cn (malware)"; content:"|0f|nvidia-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvidia-groupsvc.cn (malware)"; content:"|0f|nvidia-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odest.info (malware)"; content:"|05|odest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oneupdate.org (malware)"; content:"|09|oneupdate|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scaner-malware.net (rogue)"; content:"|15|online-scaner-malware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onsnote.com (malware)"; content:"|07|onsnote|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openbiglibrarynow.com (malware)"; content:"|11|openbiglibrarynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ownzz.100free.com (malware)"; content:"|05|ownzz|07|100free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pafefrsbasedos.com (malware)"; content:"|0e|pafefrsbasedos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payforyounow.com (malware)"; content:"|0c|payforyounow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiyidgab.com (malware)"; content:"|08|qiyidgab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r57.gen.tr (malware)"; content:"|03|r57|03|gen|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtek-group.cc (malware)"; content:"|0d|realtek-group|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtek-groupnet.cc (malware)"; content:"|10|realtek-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtek-groupnet.cn (malware)"; content:"|10|realtek-groupnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtekgroupsvc.cn (malware)"; content:"|0f|realtekgroupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regfixguide.com (rogue)"; content:"|0b|regfixguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remot.today-saturday.cn (malware)"; content:"|05|remot|0e|today-saturday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retuskf.cn (malware)"; content:"|07|retuskf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveyourwireless.com (malware)"; content:"|10|saveyourwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdf9er1.info (malware)"; content:"|07|sdf9er1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-admins.com (malware)"; content:"|0d|secure-admins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seo-traff.com (malware)"; content:"|09|seo-traff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servadmin.net (malware)"; content:"|09|servadmin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servadmin.org (malware)"; content:"|09|servadmin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server.md (malware)"; content:"|06|server|02|md"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shusstryaktube.netai.net (malware)"; content:"|0e|shusstryaktube|05|netai|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siinshoot.com (malware)"; content:"|09|siinshoot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simulogics.com (malware)"; content:"|0a|simulogics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik6.com (malware)"; content:"|07|slavik6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sleepatnight.cn (malware)"; content:"|0c|sleepatnight|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-cop.com (malware)"; content:"|08|soft-cop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-profit.ru (malware)"; content:"|0b|soft-profit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softsoldier.com (malware)"; content:"|0b|softsoldier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssdnb.net (malware)"; content:"|05|ssdnb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl-datacontrol.org (malware)"; content:"|0f|ssl-datacontrol|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl-updates.org (malware)"; content:"|0b|ssl-updates|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-7.cn (malware)"; content:"|0b|stallvars-7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stat2you.cn (malware)"; content:"|08|stat2you|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopandscanyourpc.com (rogue)"; content:"|11|stopandscanyourpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sundery.info (malware)"; content:"|07|sundery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunstats1.net (malware)"; content:"|09|sunstats1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supliment.polirom.ro (malware)"; content:"|09|supliment|07|polirom|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suqiwyk.cn (malware)"; content:"|07|suqiwyk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemprotect-zone.net (malware)"; content:"|12|systemprotect-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taulus.info (malware)"; content:"|06|taulus|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tertfunwavosgav.com (malware)"; content:"|0f|tertfunwavosgav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trialan.cn (malware)"; content:"|07|trialan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trunkilopas.com (malware)"; content:"|0b|trunkilopas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustedsite.in (malware)"; content:"|0b|trustedsite|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trusteepay.com (malware)"; content:"|0a|trusteepay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typesords.com (malware)"; content:"|09|typesords|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udikey.com (malware)"; content:"|06|udikey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uliope3wrdanogad.com (malware)"; content:"|10|uliope3wrdanogad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup up1-mail.org (malware)"; content:"|08|up1-mail|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd-center.org (malware)"; content:"|0a|upd-center|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd-central.org (malware)"; content:"|0b|upd-central|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd-services.org (malware)"; content:"|0c|upd-services|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updata-1.org (malware)"; content:"|08|updata-1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaadmin.net (malware)"; content:"|08|usaadmin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaadmin.org (malware)"; content:"|08|usaadmin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usuarios.lycos.es (malware)"; content:"|08|usuarios|05|lycos|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veselovrail.com (malware)"; content:"|0b|veselovrail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vk-mastersoft.cn (malware)"; content:"|0d|vk-mastersoft|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkovntakte.ru (malware)"; content:"|0a|vkovntakte|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup washy.info (malware)"; content:"|05|washy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmin1.com (malware)"; content:"|07|webmin1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmin1.net (malware)"; content:"|07|webmin1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmin1.org (malware)"; content:"|07|webmin1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wfef5.mine.nu (malware)"; content:"|05|wfef5|04|mine|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsregfix.com (malware)"; content:"|0a|winsregfix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wkald.com (malware)"; content:"|05|wkald|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmancer.org (malware)"; content:"|07|xmancer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxx-white-tube.net (malware)"; content:"|0e|xxx-white-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmalwarescan04.com (rogue)"; content:"|11|yourmalwarescan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytshirts.com (malware)"; content:"|08|ytshirts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yukikojack.free2.iisiisiis.com (malware)"; content:"|0a|yukikojack|05|free2|09|iisiisiis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zalaa.com (malware)"; content:"|05|zalaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeusformyfriend.x10hosting.com (malware)"; content:"|0f|zeusformyfriend|0a|x10hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zivuzjp.cn (malware)"; content:"|07|zivuzjp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zkoolz.cn (malware)"; content:"|06|zkoolz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 281s.net (zeus)"; content:"|04|281s|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4eay-protection.com (scareware)"; content:"|0f|4eay-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aasmartmoney.com (malware)"; content:"|0c|aasmartmoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afxsecuritysoftware.com (scareware)"; content:"|13|afxsecuritysoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-browser.ru (trojan)"; content:"|0b|all-browser|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almfox.com (trojan)"; content:"|06|almfox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amer0test0.cn (iframe)"; content:"|0a|amer0test0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anande.pl (RFI)"; content:"|06|anande|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancok.fileave.com (RFI)"; content:"|05|ancok|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anglemanpower.com (zeus)"; content:"|0d|anglemanpower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-3.com (scareware)"; content:"|0d|antimalware-3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-b.com (scareware)"; content:"|0d|antimalware-b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarescana4.com (scareware)"; content:"|11|antimalwarescana4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antipolicai.cn (trojan)"; content:"|0b|antipolicai|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-scan5.com (scareware)"; content:"|0d|antispy-scan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-scanb.com (scareware)"; content:"|0d|antispy-scanb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archive204975674.hlrtfeu.com (zeus)"; content:"|10|archive204975674|07|hlrtfeu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atdreamholiday.com (RFI)"; content:"|0e|atdreamholiday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attention-scanner3.com (scareware)"; content:"|12|attention-scanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avansystemsecuritystore.com (scareware)"; content:"|17|avansystemsecuritystore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baboeing.com (malware)"; content:"|08|baboeing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beprotected-b.com (scareware)"; content:"|0d|beprotected-b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beprotected9.com (scareware)"; content:"|0c|beprotected9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protection.cn (scareware)"; content:"|0f|best-protection|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scanner-f.com (scareware)"; content:"|0e|best-scanner-f|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmobidirect.com (zeus)"; content:"|0e|bestmobidirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boutique-world.com (malware)"; content:"|0e|boutique-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brvoice.com (RFI)"; content:"|07|brvoice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bwbministries.com (RFI)"; content:"|0d|bwbministries|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbnumed.or.kr (RFI)"; content:"|07|cbnumed|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celik-schmuck.de (RFI)"; content:"|0d|celik-schmuck|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkfilesherea.com (scareware)"; content:"|0f|checkfilesherea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkfilesnowa.com (scareware)"; content:"|0e|checkfilesnowa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkforspywarea.com (scareware)"; content:"|10|checkforspywarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup climot.cn (exploit)"; content:"|06|climot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clowncirus.cn (scareware)"; content:"|0a|clowncirus|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cremshell.com (rogue)"; content:"|09|cremshell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxzczxccc.com.cn (zeus)"; content:"|09|cxzczxccc|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan-1.com (scareware)"; content:"|0c|cyber-scan-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan001.com (scareware)"; content:"|0d|cyber-scan001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan008.com (scareware)"; content:"|0d|cyber-scan008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan011.com (scareware)"; content:"|0d|cyber-scan011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan026.com (malware)"; content:"|0d|cyber-scan026|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan030.com (scareware)"; content:"|0d|cyber-scan030|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan08.com (scareware)"; content:"|0c|cyber-scan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan09.com (scareware)"; content:"|0c|cyber-scan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deforum1980.net (zeus)"; content:"|0b|deforum1980|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desaparecidos.kit.net (RFI)"; content:"|0d|desaparecidos|03|kit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlink2.org (zeus)"; content:"|06|dlink2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domx0.cn (scareware)"; content:"|05|domx0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domx1.cn (scareware)"; content:"|05|domx1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-free-scanner.net (scareware)"; content:"|15|download-free-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eco-av.com (scareware)"; content:"|06|eco-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup econ1.nida.ac.th (RFI)"; content:"|05|econ1|04|nida|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emwave.knu.ac.kr (RFI)"; content:"|06|emwave|03|knu|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entombing2009.cn (scareware)"; content:"|0d|entombing2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esuipka.cn (scareware)"; content:"|07|esuipka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evelin107up.tripod.com (zeus)"; content:"|0b|evelin107up|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everlastmovie.cn (scareware)"; content:"|0d|everlastmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewiava.cn (scareware)"; content:"|06|ewiava|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewusiyt.cn (scareware)"; content:"|07|ewusiyt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exgamesbrasil.com.br (RFI)"; content:"|0d|exgamesbrasil|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairytailworld.net (RFI)"; content:"|0e|fairytailworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findprotectiona.com (scareware)"; content:"|0f|findprotectiona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firefoxavatar.cn (scareware)"; content:"|0d|firefoxavatar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstantispy01.com (scareware)"; content:"|0e|firstantispy01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flatletkick.cn (scareware)"; content:"|0b|flatletkick|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formulawebgo.cn (rogue)"; content:"|0c|formulawebgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-av-scan.in (malware)"; content:"|0c|free-av-scan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-scanner-online.net (scareware)"; content:"|13|free-scanner-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyedit.cn (malware)"; content:"|06|fyedit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcomweb.com (RFI)"; content:"|07|gcomweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-av-scan.in (malware)"; content:"|0b|get-av-scan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-freescan.in (malware)"; content:"|0c|get-freescan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golden-photo.com (trojan)"; content:"|0c|golden-photo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gombajo.hu (RFI)"; content:"|07|gombajo|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytcs.cn (zeus)"; content:"|0f|google-analytcs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gym0replace.cn (scareware)"; content:"|0b|gym0replace|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h18.hostseguro.com (RFI)"; content:"|03|h18|0a|hostseguro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackengine.net (RFI)"; content:"|0a|hackengine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hasslefreetours.co.za (RFI)"; content:"|0f|hasslefreetours|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haxopk.eu (fastflux)"; content:"|06|haxopk|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hd-mature-pornfilms.com (fastflux)"; content:"|13|hd-mature-pornfilms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlrtfek.com (fastflux)"; content:"|07|hlrtfek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlrtfet.com (fastflux)"; content:"|07|hlrtfet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlrtfey.com (fastflux)"; content:"|07|hlrtfey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indras.fileave.com (RFI)"; content:"|06|indras|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instantloadflash.net (malware)"; content:"|10|instantloadflash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intaly-tour.com (zeus)"; content:"|0b|intaly-tour|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iopentech.com (RFI)"; content:"|09|iopentech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup italianmec.com (RFI)"; content:"|0a|italianmec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcczsuzh.cn (exploit)"; content:"|08|kcczsuzh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knotnilla.com (RFI)"; content:"|09|knotnilla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lagunabich.cn (malware)"; content:"|0a|lagunabich|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadflashcode.com (malware)"; content:"|0d|loadflashcode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadsupersoft.com (rogue)"; content:"|0d|loadsupersoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mail.optima-corp.com (RFI)"; content:"|04|mail|0b|optima-corp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailboxinvite.cn (scareware)"; content:"|0d|mailboxinvite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maniacos.net (RFI)"; content:"|08|maniacos|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media1960.ru (zeus)"; content:"|09|media1960|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memll.biz (malware)"; content:"|05|memll|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscoop.net (malware)"; content:"|0a|microscoop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobi-sripts.com (exploit)"; content:"|0b|mobi-sripts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup module.cwsurf.de (RFI)"; content:"|06|module|06|cwsurf|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monocline.cn (scareware)"; content:"|09|monocline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozzillaclone.cn (scareware)"; content:"|0d|mozzillaclone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaexpertsgroup.net (malware)"; content:"|16|multimediaexpertsgroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myluxurychalet.com (RFI)"; content:"|0e|myluxurychalet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nero872.cn (ruski)"; content:"|07|nero872|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oishi90.fileave.com (RFI)"; content:"|07|oishi90|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldman-game.com (fastflux)"; content:"|0b|oldman-game|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinestarter.cn (scareware)"; content:"|0d|onlinestarter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palmfosx.com (trojan)"; content:"|08|palmfosx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petdoso.com (malware)"; content:"|07|petdoso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppslaterent.com (RFI)"; content:"|0b|ppslaterent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richardnewbie.fileave.com (RFI)"; content:"|0d|richardnewbie|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup router22.50webs.com (RFI)"; content:"|08|router22|06|50webs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ru168.cn (malware)"; content:"|05|ru168|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-clear.com (rogue)"; content:"|0e|scan-and-clear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfilesherea.com (scareware)"; content:"|0e|scanfilesherea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansecurityguards.cn (malware)"; content:"|12|scansecurityguards|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scremsghell.com (rogue)"; content:"|0b|scremsghell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup script-search-www.com (exploit)"; content:"|11|script-search-www|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureitem.cn (scareware)"; content:"|0a|secureitem|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityholder.net (zeus)"; content:"|0e|securityholder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedhyof.com (fastflux)"; content:"|07|sedhyof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sejongit.com (RFI)"; content:"|08|sejongit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senrofay.cn (zeus)"; content:"|08|senrofay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup separator2009.cn (scareware)"; content:"|0d|separator2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shilee.com (RFI)"; content:"|06|shilee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slwride.com (rogue)"; content:"|07|slwride|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart89.fileave.com (RFI)"; content:"|07|smart89|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solidresistance.cn (scareware)"; content:"|0f|solidresistance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-scan9.com (scareware)"; content:"|0d|spyware-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surgingnurse.cn (scareware)"; content:"|0c|surgingnurse|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsviewer.cn (zeus)"; content:"|09|tdsviewer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipocat06.info (RFI)"; content:"|09|tipocat06|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup today-scan4.com (scareware)"; content:"|0b|today-scan4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup today-scann.com (scareware)"; content:"|0b|today-scann|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomagrinow.justfree.com (RFI)"; content:"|0a|tomagrinow|08|justfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topdivision.cn (trojan)"; content:"|0b|topdivision|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topscan3.com (malware)"; content:"|08|topscan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafdomins.cn (scareware)"; content:"|0a|trafdomins|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukliit.net (zeus)"; content:"|06|ukliit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyveza.com (fastflux)"; content:"|06|uyveza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuescana.com (scareware)"; content:"|0a|valuescana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuewebscana.com (scareware)"; content:"|0d|valuewebscana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visual.fileave.com (RFI)"; content:"|06|visual|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkitaep.com (fastflux)"; content:"|07|vkitaep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvind.com (RFI)"; content:"|05|vvind|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w-e-g.cn (zeus)"; content:"|05|w-e-g|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wait-for-scanning2.com (scareware)"; content:"|12|wait-for-scanning2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup we-group.cn (zeus)"; content:"|08|we-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-scanm.com (scareware)"; content:"|09|web-scanm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weddingscatalina.com (phishing)"; content:"|10|weddingscatalina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wild-gangbang-sex.com (fastflux)"; content:"|11|wild-gangbang-sex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup withkor.net (RFI)"; content:"|07|withkor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wlsestemlives.com (RFI)"; content:"|0d|wlsestemlives|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdurex.com (trojan)"; content:"|06|xdurex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantispy-1.com (scareware)"; content:"|0d|yourantispy-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantispy-8.com (scareware)"; content:"|0d|yourantispy-8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantispy-a.com (scareware)"; content:"|0d|yourantispy-a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmalwarescan3.com (scareware)"; content:"|10|yourmalwarescan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmalwarescan7.com (scareware)"; content:"|10|yourmalwarescan7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yx1l.cn (malware)"; content:"|04|yx1l|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zlinske-reality.cz (RFI)"; content:"|0f|zlinske-reality|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 00002009.zapto.org (zeus)"; content:"|08|00002009|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 22ger.cn (malware)"; content:"|05|22ger|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33hrf.cn (malware)"; content:"|05|33hrf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6arada.net (zeus)"; content:"|06|6arada|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agoravai11.tempsite.ws (trojan)"; content:"|0a|agoravai11|08|tempsite|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armadaneo.info (harmful)"; content:"|09|armadaneo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbbboom.com (malware)"; content:"|07|bbbboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyak.co.uk (zeus)"; content:"|07|bbttyak|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyak.org.uk (zeus)"; content:"|07|bbttyak|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyam.co.uk (zeus)"; content:"|07|bbttyam|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyam.me.uk (zeus)"; content:"|07|bbttyam|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyap.co.uk (zeus)"; content:"|07|bbttyap|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyap.me.uk (zeus)"; content:"|07|bbttyap|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyaz.co.uk (zeus)"; content:"|07|bbttyaz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbttyaz.me.uk (zeus)"; content:"|07|bbttyaz|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bichalina.cn (zeus)"; content:"|09|bichalina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubenchik.net (zeus)"; content:"|09|bubenchik|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buzizoo2.com (malware)"; content:"|08|buzizoo2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dietcoaches.com (zeus)"; content:"|0b|dietcoaches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dilokqv.eu (fastflux)"; content:"|07|dilokqv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dontstop185.net (zeus)"; content:"|0b|dontstop185|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1g.co.uk (zeus)"; content:"|08|easder1g|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1l.co.uk (zeus)"; content:"|08|easder1l|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easder1m.co.uk (zeus)"; content:"|08|easder1m|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqf.eu (fastflux)"; content:"|08|edilokqf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqi.eu (fastflux)"; content:"|08|edilokqi|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqm.eu (fastflux)"; content:"|08|edilokqm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqn.eu (fastflux)"; content:"|08|edilokqn|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqr.eu (fastflux)"; content:"|08|edilokqr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqs.eu (fastflux)"; content:"|08|edilokqs|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqu.eu (fastflux)"; content:"|08|edilokqu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edilokqx.eu (fastflux)"; content:"|08|edilokqx|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filatok.com (zeus)"; content:"|07|filatok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fluousness.net (zeus)"; content:"|0a|fluousness|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fut763jrs4l.com (zeus)"; content:"|0b|fut763jrs4l|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrahawa.eu (zeus)"; content:"|09|gerrahawa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrahowa.eu (zeus)"; content:"|09|gerrahowa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrakawa.eu (zeus)"; content:"|09|gerrakawa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrakowa.eu (zeus)"; content:"|09|gerrakowa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerralowa.eu (zeus)"; content:"|09|gerralowa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerraoowa.eu (zeus)"; content:"|09|gerraoowa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrasasa.eu (zeus)"; content:"|09|gerrasasa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrasase.eu (zeus)"; content:"|09|gerrasase|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerrasasq.eu (zeus)"; content:"|09|gerrasasq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gld111b.ws (zeus)"; content:"|07|gld111b|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenhead.cn (zeus)"; content:"|09|greenhead|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfae.eu (phish)"; content:"|07|h1erfae|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfai.eu (phish)"; content:"|07|h1erfai|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfaj.eu (phish)"; content:"|07|h1erfaj|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfaq.eu (phish)"; content:"|07|h1erfaq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfar.eu (phish)"; content:"|07|h1erfar|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfat.eu (phish)"; content:"|07|h1erfat|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfau.eu (phish)"; content:"|07|h1erfau|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfaw.eu (phish)"; content:"|07|h1erfaw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h1erfay.eu (phish)"; content:"|07|h1erfay|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happykinder.org (zeus)"; content:"|0b|happykinder|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikok.eu (zeus)"; content:"|08|heiiikok|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikoy.eu (zeus)"; content:"|08|heiiikoy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikul.eu (zeus)"; content:"|08|heiiikul|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikum.eu (zeus)"; content:"|08|heiiikum|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikuv.eu (zeus)"; content:"|08|heiiikuv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heiiikuy.eu (zeus)"; content:"|08|heiiikuy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hewj.co.cc (malware)"; content:"|04|hewj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulasoftz.cn (zeus)"; content:"|09|hulasoftz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i1st.net.cn (zeus)"; content:"|04|i1st|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iark.net (harmful)"; content:"|04|iark|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idllsit.com (zeus)"; content:"|07|idllsit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ij1tli.net (zeus)"; content:"|06|ij1tli|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup immikiut1.cz (zeus)"; content:"|09|immikiut1|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j1t1iil.com (zeus)"; content:"|07|j1t1iil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j1t1iil.eu (zeus)"; content:"|07|j1t1iil|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j1t1iil.net (zeus)"; content:"|07|j1t1iil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup judns.net (malware)"; content:"|05|judns|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keysiolo.net (zeus)"; content:"|08|keysiolo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kripakripchampion.ru (zeus)"; content:"|11|kripakripchampion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limon4ik.co.cc (malware)"; content:"|08|limon4ik|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj1tli.com (zeus)"; content:"|06|lj1tli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj1tli.net (zeus)"; content:"|06|lj1tli|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj1tll.com (zeus)"; content:"|06|lj1tll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj1tll.net (zeus)"; content:"|06|lj1tll|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ll7ll.com.es (zeus)"; content:"|05|ll7ll|03|com|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lnxwy.com (malware)"; content:"|05|lnxwy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longulen.net (zeus)"; content:"|08|longulen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltlil1.com (zeus)"; content:"|06|ltlil1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltlil1.net (zeus)"; content:"|06|ltlil1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mailzippo.info (zeus)"; content:"|09|mailzippo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mateoarriba.com (zeus)"; content:"|0b|mateoarriba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megicpatt.com (zeus)"; content:"|09|megicpatt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1a.co (phish)"; content:"|07|milki1a|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1a.me (phish)"; content:"|07|milki1a|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1e.me (phish)"; content:"|07|milki1e|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1g.me (phish)"; content:"|07|milki1g|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1i.co (phish)"; content:"|07|milki1i|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1l.co (phish)"; content:"|07|milki1l|02|co"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milki1y.me (phish)"; content:"|07|milki1y|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111sae.eu (zeus)"; content:"|07|n111sae|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111sak.eu (zeus)"; content:"|07|n111sak|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111sap.eu (zeus)"; content:"|07|n111sap|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111say.eu (zeus)"; content:"|07|n111say|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n111saz.eu (zeus)"; content:"|07|n111saz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmoon-movie.net (malware)"; content:"|0d|newmoon-movie|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniuji1.eu (zeus)"; content:"|07|nniuji1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniujih.eu (zeus)"; content:"|07|nniujih|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniujo1.eu (zeus)"; content:"|07|nniujo1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniukif.eu (zeus)"; content:"|07|nniukif|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniukih.eu (zeus)"; content:"|07|nniukih|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniukik.eu (zeus)"; content:"|07|nniukik|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniukiw.eu (zeus)"; content:"|07|nniukiw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniukiz.eu (zeus)"; content:"|07|nniukiz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniuxih.eu (zeus)"; content:"|07|nniuxih|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nniuxiw.eu (zeus)"; content:"|07|nniuxiw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nytre4rt.co.uk (zeus)"; content:"|08|nytre4rt|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nytre4ru.co.uk (zeus)"; content:"|08|nytre4ru|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awa.eu (phish)"; content:"|08|nyuh1awa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awb.eu (phish)"; content:"|08|nyuh1awb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awc.eu (phish)"; content:"|08|nyuh1awc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awd.eu (phish)"; content:"|08|nyuh1awd|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awe.eu (zeus)"; content:"|08|nyuh1awe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awf.eu (phish)"; content:"|08|nyuh1awf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awg.eu (phish)"; content:"|08|nyuh1awg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awh.eu (phish)"; content:"|08|nyuh1awh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awm.eu (phish)"; content:"|08|nyuh1awm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awn.eu (zeus)"; content:"|08|nyuh1awn|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1aws.eu (phish)"; content:"|08|nyuh1aws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awt.eu (phish)"; content:"|08|nyuh1awt|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awv.eu (phish)"; content:"|08|nyuh1awv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awx.eu (phish)"; content:"|08|nyuh1awx|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuh1awz.eu (zeus)"; content:"|08|nyuh1awz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwa.co.uk (zeus)"; content:"|09|nyuy12qwa|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwf.co.uk (zeus)"; content:"|09|nyuy12qwf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwf.eu (zeus)"; content:"|09|nyuy12qwf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwg.co.uk (zeus)"; content:"|09|nyuy12qwg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwg.eu (zeus)"; content:"|09|nyuy12qwg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qws.co.uk (zeus)"; content:"|09|nyuy12qws|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qws.eu (zeus)"; content:"|09|nyuy12qws|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyuy12qwz.co.uk (zeus)"; content:"|09|nyuy12qwz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogurchik.cn (zeus)"; content:"|08|ogurchik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololii.co.uk (zeus)"; content:"|06|ololii|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololii.eu (zeus)"; content:"|06|ololii|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiw.co.uk (zeus)"; content:"|06|ololiw|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiw.eu (zeus)"; content:"|06|ololiw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiy.co.uk (zeus)"; content:"|06|ololiy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiy.eu (zeus)"; content:"|06|ololiy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiz.co.uk (zeus)"; content:"|06|ololiz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ololiz.eu (zeus)"; content:"|06|ololiz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ontvertenchio.org (zeus)"; content:"|0d|ontvertenchio|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opengl17.freehostia.com (zeus)"; content:"|08|opengl17|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podzemje.cn (zeus)"; content:"|08|podzemje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikib.eu (zeus)"; content:"|07|pouikib|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikic.eu (zeus)"; content:"|07|pouikic|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikie.eu (zeus)"; content:"|07|pouikie|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikif.eu (zeus)"; content:"|07|pouikif|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikig.eu (zeus)"; content:"|07|pouikig|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikir.eu (zeus)"; content:"|07|pouikir|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikis.eu (zeus)"; content:"|07|pouikis|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikit.eu (zeus)"; content:"|07|pouikit|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikiv.eu (zeus)"; content:"|07|pouikiv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikiw.eu (zeus)"; content:"|07|pouikiw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikix.eu (zeus)"; content:"|07|pouikix|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pouikiy.eu (zeus)"; content:"|07|pouikiy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup probrosikanet.org (zeus)"; content:"|0d|probrosikanet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwecvgfjk.info (malspam)"; content:"|09|qwecvgfjk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redstars.ax3.net (zeus)"; content:"|08|redstars|03|ax3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rodjer.com (zeus)"; content:"|06|rodjer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrref1aaz.eu (zeus)"; content:"|09|rrref1aaz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrref1akz.eu (zeus)"; content:"|09|rrref1akz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrref1ykz.eu (zeus)"; content:"|09|rrref1ykz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrrefjokz.eu (zeus)"; content:"|09|rrrefjokz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saaasak.eu (zeus)"; content:"|07|saaasak|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saaasav.eu (zeus)"; content:"|07|saaasav|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sisters-try-strapon.com (fastflux)"; content:"|13|sisters-try-strapon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streammediastorage.com (malware)"; content:"|12|streammediastorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subaruservice.cn (zeus)"; content:"|0d|subaruservice|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thecowrd.com (zeus)"; content:"|08|thecowrd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tj1fiil.com (zeus)"; content:"|07|tj1fiil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tj1fiil.net (zeus)"; content:"|07|tj1fiil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tj1fiil.tc (zeus)"; content:"|07|tj1fiil|02|tc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwa1.eu (phish)"; content:"|07|tt1qwa1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwa1.me (phish)"; content:"|07|tt1qwa1|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwae.eu (phish)"; content:"|07|tt1qwae|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwae.me (phish)"; content:"|07|tt1qwae|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwaq.co.uk (phish)"; content:"|07|tt1qwaq|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwaq.eu (phish)"; content:"|07|tt1qwaq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwaq.me.uk (phish)"; content:"|07|tt1qwaq|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwar.co.uk (phish)"; content:"|07|tt1qwar|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwar.eu (phish)"; content:"|07|tt1qwar|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwar.me.uk (phish)"; content:"|07|tt1qwar|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwat.co.uk (phish)"; content:"|07|tt1qwat|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwat.eu (phish)"; content:"|07|tt1qwat|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tt1qwat.me.uk (phish)"; content:"|07|tt1qwat|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuttakto.com (zeus)"; content:"|08|tuttakto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygerah.co.uk (zeus)"; content:"|07|tygerah|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygerah.eu (zeus)"; content:"|07|tygerah|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygerak.co.uk (zeus)"; content:"|07|tygerak|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygerak.eu (zeus)"; content:"|07|tygerak|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygeraw.co.uk (zeus)"; content:"|07|tygeraw|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygeraw.eu (zeus)"; content:"|07|tygeraw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygeraz.co.uk (zeus)"; content:"|07|tygeraz|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujihkei.eu (zeus)"; content:"|07|ujihkei|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujihkni.eu (zeus)"; content:"|07|ujihkni|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujihkui.eu (zeus)"; content:"|07|ujihkui|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukliit.cn (zeus)"; content:"|06|ukliit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ushenkohuivolosatiy.ru (zeus)"; content:"|13|ushenkohuivolosatiy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wildbunchwtf.com (zeus)"; content:"|0c|wildbunchwtf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-update210.com (zeus)"; content:"|11|windows-update210|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woonhae.com (malware)"; content:"|07|woonhae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yag0yag0.co.cc (malware)"; content:"|08|yag0yag0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandex.co.cc (zeus)"; content:"|06|yandex|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qab.eu (phish)"; content:"|06|yh1qab|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qab.me.uk (phish)"; content:"|06|yh1qab|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qak.co.uk (phish)"; content:"|06|yh1qak|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qak.eu (phish)"; content:"|06|yh1qak|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qak.me.uk (phish)"; content:"|06|yh1qak|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qal.co.uk (zeus)"; content:"|06|yh1qal|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qal.eu (phish)"; content:"|06|yh1qal|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qao.co.uk (zeus)"; content:"|06|yh1qao|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qao.eu (phish)"; content:"|06|yh1qao|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qao.me.uk (phish)"; content:"|06|yh1qao|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qaz.eu (zeus)"; content:"|06|yh1qaz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yh1qaz.me.uk (phish)"; content:"|06|yh1qaz|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwe1a.co.uk (zeus)"; content:"|08|yhaqwe1a|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwe1q.co.uk (zeus)"; content:"|08|yhaqwe1q|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwe1r.co.uk (zeus)"; content:"|08|yhaqwe1r|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwi1g.co.uk (zeus)"; content:"|08|yhaqwi1g|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwi1h.co.uk (zeus)"; content:"|08|yhaqwi1h|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwi1l.co.uk (zeus)"; content:"|08|yhaqwi1l|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwi1m.co.uk (zeus)"; content:"|08|yhaqwi1m|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaqwi1p.co.uk (zeus)"; content:"|08|yhaqwi1p|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhherasde.co.uk (zeus)"; content:"|0a|yhhherasde|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhherasdp.co.uk (zeus)"; content:"|0a|yhhherasdp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhheraski.co.uk (zeus)"; content:"|0a|yhhheraski|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhheraskog.co.uk (zeus)"; content:"|0b|yhhheraskog|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhheraskol.co.uk (zeus)"; content:"|0b|yhhheraskol|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhhheraskoy.co.uk (zeus)"; content:"|0b|yhhheraskoy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourskinonline.com (zeus)"; content:"|0e|yourskinonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yy1azsva.eu (zeus)"; content:"|08|yy1azsva|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yy1azsvq.eu (zeus)"; content:"|08|yy1azsvq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yy1azsvz.eu (zeus)"; content:"|08|yy1azsvz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1asvf.eu (zeus)"; content:"|08|yyy1asvf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1azsy.eu (zeus)"; content:"|08|yyy1azsy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1azvg.eu (zeus)"; content:"|08|yyy1azvg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyy1zsve.eu (zeus)"; content:"|08|yyy1zsve|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zzzz.ellmada.co.cc (malware)"; content:"|04|zzzz|07|ellmada|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-vpro21.com (rogue)"; content:"|08|a-vpro21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activate-antivirus.com (rogue)"; content:"|12|activate-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanced-virus-remover-2010.com (rogue)"; content:"|1b|advanced-virus-remover-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agag44.com (gumblar)"; content:"|06|agag44|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agenturadomov.cz (gumblar)"; content:"|0d|agenturadomov|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aletcenter.com (rogue)"; content:"|0a|aletcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amr.kz (trojan)"; content:"|03|amr|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angelsinuniform.com (gumblar)"; content:"|0f|angelsinuniform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-software.org (rogue)"; content:"|14|antimalware-software|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aplikapublicidad.es (zeus)"; content:"|10|aplikapublicidad|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asyouwishwed.biz (gumblar)"; content:"|0c|asyouwishwed|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-pro-2010.com (rogue)"; content:"|0b|av-pro-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avprotectioncenter.com (rogue)"; content:"|12|avprotectioncenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-anti-virus6.com (rogue)"; content:"|10|best-anti-virus6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestremoverpro.com (rogue)"; content:"|0e|bestremoverpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscanonline.info (rogue)"; content:"|0e|bestscanonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bikingrealtor.net (gumblar)"; content:"|0d|bikingrealtor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bolcsvolgyi.hu (gumblar)"; content:"|0b|bolcsvolgyi|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsersecurityaddon.com (rogue)"; content:"|14|browsersecurityaddon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulgaristanuniversiteleri.org (gumblar)"; content:"|19|bulgaristanuniversiteleri|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cartoon-sex-links.com (rfi)"; content:"|11|cartoon-sex-links|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casghnamia.com (trojan)"; content:"|0a|casghnamia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashnzamia.com (trojan)"; content:"|0a|cashnzamia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaikrman.com (trojan)"; content:"|09|chaikrman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlinenow.info (rogue)"; content:"|0e|checkonlinenow|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlineonline.info (rogue)"; content:"|11|checkonlineonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlinesite.info (rogue)"; content:"|0f|checkonlinesite|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlinestore.info (rogue)"; content:"|10|checkonlinestore|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlinetoday.info (rogue)"; content:"|10|checkonlinetoday|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkwindowsupdate.com (trojan)"; content:"|12|checkwindowsupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrisexpo.com (rfi)"; content:"|09|chrisexpo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colaran.com (trojan)"; content:"|07|colaran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corclan.com (rfi)"; content:"|07|corclan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpattwinterp.com (exploit)"; content:"|0c|cpattwinterp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cw.ubru.ac.th (rfi)"; content:"|02|cw|04|ubru|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberstrongstore.com (rogue)"; content:"|10|cyberstrongstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detect-spyware1.com (rogue)"; content:"|0f|detect-spyware1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detect-spyware3.com (rogue)"; content:"|0f|detect-spyware3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detect-spyware5.com (rogue)"; content:"|0f|detect-spyware5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detect-spyware7.com (rogue)"; content:"|0f|detect-spyware7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detect-spyware9.com (rogue)"; content:"|0f|detect-spyware9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr7.com (rogue)"; content:"|0c|downloadavr7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup driverupdatesystem.com (rogue)"; content:"|12|driverupdatesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup errtz.cn (trojan)"; content:"|05|errtz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmkolik.net (gumblar)"; content:"|09|filmkolik|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foro.gamesquality.com (gumblar)"; content:"|04|foro|0c|gamesquality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotothhi.be (gumblar)"; content:"|08|fotothhi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freecheckonline.info (rogue)"; content:"|0f|freecheckonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemaniya.cn (pdfexploit)"; content:"|0a|freemaniya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freescanonline.info (rogue)"; content:"|0e|freescanonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gateshis.cn (malware)"; content:"|08|gateshis|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-antispyware7.com (rogue)"; content:"|11|good-antispyware7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-antispyware8.com (rogue)"; content:"|11|good-antispyware8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analystisks.us (exploit)"; content:"|12|google-analystisks|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattubesusa.com (rogue)"; content:"|0d|greattubesusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hana.nef-i.co.kr (rfi)"; content:"|04|hana|05|nef-i|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hannabarbera.com.br (gumblar)"; content:"|0c|hannabarbera|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haydikaradenize.com (gumblar)"; content:"|0f|haydikaradenize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htaqua.ru (rfi)"; content:"|06|htaqua|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i1st.co.cc (zeus)"; content:"|04|i1st|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibdf-deutschland.de (gumblar)"; content:"|10|ibdf-deutschland|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkkak.cn (exploit)"; content:"|06|inkkak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetprotectectionscan.com (rogue)"; content:"|19|internetprotectectionscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jatulintarhan.net (gumblar)"; content:"|0d|jatulintarhan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnson.co.th (gumblar)"; content:"|07|johnson|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kamunyugi.cn (exploit)"; content:"|09|kamunyugi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kathrynmetcalf.com (gumblar)"; content:"|0e|kathrynmetcalf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcr-net.de (gumblar)"; content:"|07|kcr-net|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-virusa.com (rogue)"; content:"|0b|kill-virusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-viruse.com (rogue)"; content:"|0b|kill-viruse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingofbelgrade.com (gumblar)"; content:"|0e|kingofbelgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakyrnikcup.cz (gumblar)"; content:"|0b|lakyrnikcup|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leucodistrofia.es (rfi)"; content:"|0e|leucodistrofia|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifeecond.com (trojan)"; content:"|09|lifeecond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveantivirusproscanner.com (rogue)"; content:"|17|liveantivirusproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livebmx.ru (rfi)"; content:"|07|livebmx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lou-ferrigno.info (gumblar)"; content:"|0c|lou-ferrigno|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magnoliamails.com (gumblar)"; content:"|0d|magnoliamails|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-url.com (rogue)"; content:"|0b|malware-url|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup markokaldur.com (exploits)"; content:"|0b|markokaldur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcsdp.com (gumblar)"; content:"|05|mcsdp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mefa.ws (exploit)"; content:"|04|mefa|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melstra-techniek.nl (gumblar)"; content:"|10|melstra-techniek|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mifconsulting.net (gumblar)"; content:"|0d|mifconsulting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misterplasma.be (rfi)"; content:"|0c|misterplasma|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnogotrafika.cn (trojan)"; content:"|0c|mnogotrafika|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobydickrock.ru (gumblar)"; content:"|0c|mobydickrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multiairservice.com (fakeav)"; content:"|0f|multiairservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybestline.cn (zeus)"; content:"|0a|mybestline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycheckonline.info (rogue)"; content:"|0d|mycheckonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerupdate01.com (rogue)"; content:"|12|mycomputerupdate01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputerupdate5.com (rogue)"; content:"|11|mycomputerupdate5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myrussia.kz (gumblar)"; content:"|08|myrussia|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newcheckonline.info (rogue)"; content:"|0e|newcheckonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup norrtulls.se (zeus)"; content:"|09|norrtulls|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup o0w0o.com (gumblar)"; content:"|05|o0w0o|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocscanner.com (rogue)"; content:"|09|ocscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oeysymbol.com (trojan)"; content:"|09|oeysymbol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogis.se (rfi)"; content:"|04|ogis|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olight-usa.com (gumblar)"; content:"|0a|olight-usa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityscanv15.com (rogue)"; content:"|15|onlinesecurityscanv15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oracleoledb.cn (zeus)"; content:"|0b|oracleoledb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osguard-pro.com (rogue)"; content:"|0b|osguard-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ozguvenplastik.com (gumblar)"; content:"|0e|ozguvenplastik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paty88.xpg.com.br (rfi)"; content:"|06|paty88|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pifesecond.com (trojan)"; content:"|0a|pifesecond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psgtech72.com (gumblar)"; content:"|09|psgtech72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quaoegame.com (trojan)"; content:"|09|quaoegame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red-devil-sport-club.gymdb.com (gumblar)"; content:"|14|red-devil-sport-club|05|gymdb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removespyware-7.com (rogue)"; content:"|0f|removespyware-7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removespywarev1.com (rogue)"; content:"|0f|removespywarev1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removespywarev3.com (rogue)"; content:"|0f|removespywarev3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scottstuart.org (rfi)"; content:"|0b|scottstuart|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secmodify.com (rogue)"; content:"|09|secmodify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sejoong.tourskorea.com (gumblar)"; content:"|07|sejoong|0a|tourskorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sensor.ws (c&c)"; content:"|06|sensor|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siva4kids.org (gumblar)"; content:"|09|siva4kids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sksolvesborg.se (gumblar)"; content:"|0c|sksolvesborg|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softveteran.com (rogue)"; content:"|0b|softveteran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spin-nds.de (gumblar)"; content:"|08|spin-nds|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steps-ironcup.com (exploit)"; content:"|0d|steps-ironcup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stockbuzzindia.com (gumblar)"; content:"|0e|stockbuzzindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stoned-ip.com (malware)"; content:"|09|stoned-ip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storefront.vacuformstore.com (rfi)"; content:"|0a|storefront|0d|vacuformstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stortfordaircadets.org.uk (pdfexploit)"; content:"|12|stortfordaircadets|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success-biz.com (zeus)"; content:"|0b|success-biz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunkenlibrary.org (gumblar)"; content:"|0d|sunkenlibrary|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tapiroten.info (malware)"; content:"|09|tapiroten|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thailocal.sru.ac.th (gumblar)"; content:"|09|thailocal|03|sru|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thalassapromotion.eu (gumblar)"; content:"|11|thalassapromotion|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefeedwater.com (exploit)"; content:"|0c|thefeedwater|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-scanner11.com (rogue)"; content:"|0d|top-scanner11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-scanner2.com (rogue)"; content:"|0c|top-scanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-scanner9.com (rogue)"; content:"|0c|top-scanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topantimalwarescan5.com (rogue)"; content:"|13|topantimalwarescan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tophotpc-check.com (rogue)"; content:"|0e|tophotpc-check|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transmarecuador.com (gumblar)"; content:"|0f|transmarecuador|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uakegame.com (trojan)"; content:"|08|uakegame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uchikawa.ne.jp (gumblar)"; content:"|08|uchikawa|02|ne|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujcar.deva.rdsnet.ro (rfi)"; content:"|05|ujcar|04|deva|06|rdsnet|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unsecurewebsites.com (rogue)"; content:"|10|unsecurewebsites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatesystem00.com (rogue)"; content:"|0e|updatesystem00|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usepetrol2earn.com (gumblar)"; content:"|0e|usepetrol2earn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utka3medrdosubor.com (rogue)"; content:"|10|utka3medrdosubor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detect08.com (rogue)"; content:"|0e|virus-detect08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbavv.com (exploit)"; content:"|05|wbavv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup werkgruppe-donau.de (zeus)"; content:"|10|werkgruppe-donau|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windesktopdefender.com (rogue)"; content:"|12|windesktopdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winscanner11.com (rogue)"; content:"|0c|winscanner11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winscanner16.com (rogue)"; content:"|0c|winscanner16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcorp.net.cn (zeus)"; content:"|05|xcorp|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yondental.co.kr (gumblar)"; content:"|09|yondental|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpicturehoster.com (malware)"; content:"|11|yourpicturehoster|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytdb.ru (zeus)"; content:"|04|ytdb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaders.cn (malware)"; content:"|06|zaders|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeon29.ws (rogue)"; content:"|06|zeon29|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoolanalizer.cn (trojan)"; content:"|0c|zoolanalizer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1stantivirusplus.com (rogue)"; content:"|10|1stantivirusplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3d-family-orgies.com (botnet)"; content:"|10|3d-family-orgies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7806320.ru (rfi)"; content:"|07|7806320|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abundder.com (malware)"; content:"|08|abundder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agn6m.cn (exploits)"; content:"|05|agn6m|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahkjkw.com (harmful)"; content:"|06|ahkjkw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-scan9.com (rogue)"; content:"|09|all-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allskilledtrades.com (rfi)"; content:"|10|allskilledtrades|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arbitrageconspiracylaunch.info (exploits)"; content:"|19|arbitrageconspiracylaunch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arobeska.ru (virtool)"; content:"|08|arobeska|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arquivos.biz.nf (rfi)"; content:"|08|arquivos|03|biz|02|nf"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artcraftjewels.com (zeus)"; content:"|0e|artcraftjewels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ateslidullar.net (malware)"; content:"|0c|ateslidullar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bale.ws (malware)"; content:"|04|bale|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baltimorecrashpads.com (rfi)"; content:"|12|baltimorecrashpads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup base-scanner3.com (rogue)"; content:"|0d|base-scanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbtedd.info (luckysploit)"; content:"|06|bbtedd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured2.com (rogue)"; content:"|0b|be-secured2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizzybee.nl (zeus)"; content:"|08|bizzybee|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockkeeper.com (malware)"; content:"|0b|blockkeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockscanner.com (rogue)"; content:"|0c|blockscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brd-jobs.com (botnet)"; content:"|08|brd-jobs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup briderscapes.info (zeus)"; content:"|0c|briderscapes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafropy.cn (rogue)"; content:"|07|cafropy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cammaru.cn (trojan)"; content:"|07|cammaru|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinoelegance.com (botnet)"; content:"|0e|casinoelegance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cerdiko.cn (rogue)"; content:"|07|cerdiko|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cexiky.cn (rogue)"; content:"|06|cexiky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinamega.net (zbot)"; content:"|09|chinamega|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cibtare.cn (rogue)"; content:"|07|cibtare|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciduswy.cn (rogue)"; content:"|07|ciduswy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colqrand.com (trojan)"; content:"|08|colqrand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corpscanalert.com (exploit)"; content:"|0d|corpscanalert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup courtsecuritygroup.com (rogue)"; content:"|12|courtsecuritygroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crferari.info (malware)"; content:"|08|crferari|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crissycriss.org (trojan)"; content:"|0b|crissycriss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dads-sperm-in-daughters.com (botnet)"; content:"|17|dads-sperm-in-daughters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbakd.com (trojan)"; content:"|05|dbakd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deth-test.ru (exploits)"; content:"|09|deth-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup difusion.com.mx (rfi)"; content:"|08|difusion|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotroot.su (malware)"; content:"|07|dotroot|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dox0.cn (malware)"; content:"|04|dox0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edamym.cn (rogue)"; content:"|06|edamym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edayty.cn (rogue)"; content:"|06|edayty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edeifu.cn (rogue)"; content:"|06|edeifu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edivuka.cn (rogue)"; content:"|07|edivuka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euroliit.net (malware)"; content:"|08|euroliit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everytimewetouch.net (zeus)"; content:"|10|everytimewetouch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evgs-hohwald.de (rfi)"; content:"|0c|evgs-hohwald|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eviyzru.cn (rogue)"; content:"|07|eviyzru|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evouga.cn (rogue)"; content:"|06|evouga|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evoutma.cn (rogue)"; content:"|07|evoutma|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evuegsi.cn (rogue)"; content:"|07|evuegsi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evujyog.cn (rogue)"; content:"|07|evujyog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evybine.cn (rogue)"; content:"|07|evybine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exodus110.com (trojan)"; content:"|09|exodus110|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookk.us (trojandownloader)"; content:"|09|facebookk|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fafadvd.cn (trojan)"; content:"|07|fafadvd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup familylink.or.kr (rfi)"; content:"|0a|familylink|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fever98radio.com (malware)"; content:"|0c|fever98radio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findproper.org (rogue)"; content:"|0a|findproper|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finedcar.com (trojan)"; content:"|08|finedcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forredasto.info (luckysploit)"; content:"|0a|forredasto|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.siamchill.com (rfi)"; content:"|05|forum|09|siamchill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum77.cn (zbot)"; content:"|07|forum77|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fraskes.info (luckysploit)"; content:"|07|fraskes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freunde-testen.com.br (malware)"; content:"|0e|freunde-testen|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frisaprodutora.com.br (rfi)"; content:"|0e|frisaprodutora|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gksdh.cn (malware)"; content:"|05|gksdh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go.fuckmoymosk.com (exploitpack)"; content:"|02|go|0b|fuckmoymosk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold1-h111b.ws (zeus)"; content:"|0b|gold1-h111b|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grb7u.cn (exploits)"; content:"|05|grb7u|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-pepper.cn (rogue)"; content:"|0c|green-pepper|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guneyauto.com (malware)"; content:"|09|guneyauto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjgcx7xhjsl4.com (zeus)"; content:"|0c|hjgcx7xhjsl4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hometubevideo.net (trojan)"; content:"|0d|hometubevideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydrateam.cn (zeus)"; content:"|09|hydrateam|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hzone666.cn (malware)"; content:"|08|hzone666|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i9mr9u6i35.com (botnet)"; content:"|0a|i9mr9u6i35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iglimario.info (luckysploit)"; content:"|09|iglimario|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infadata.co.cc (zeus)"; content:"|08|infadata|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inflame2009.cn (rogue)"; content:"|0b|inflame2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interposition.cn (rogue)"; content:"|0d|interposition|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqckly.ru (fastflux)"; content:"|06|iqckly|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iquotient.ru (fastflux)"; content:"|09|iquotient|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ismailia1928.net (malware)"; content:"|0c|ismailia1928|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwebkorea.net (rfi)"; content:"|09|iwebkorea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwillhavesexygirls.com (malware)"; content:"|12|iwillhavesexygirls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jainpage.com (rogue)"; content:"|08|jainpage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jucefresh.com (trojan)"; content:"|09|jucefresh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juixefresh.com (trojan)"; content:"|0a|juixefresh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kachmp3.cn (exploit)"; content:"|07|kachmp3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcmusa.org (trojan)"; content:"|06|kcmusa|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiralikarababul.com (exploits)"; content:"|0f|kiralikarababul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klimabul.com (malware)"; content:"|08|klimabul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakeshorevolleyball.org (zbot)"; content:"|13|lakeshorevolleyball|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lazosbu.cn (rogue)"; content:"|07|lazosbu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legendgundogs.com (trojan)"; content:"|0d|legendgundogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lesrynu.cn (rogue)"; content:"|07|lesrynu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup let-meguardyourzone.net (trojan)"; content:"|13|let-meguardyourzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifedrom.ru (fastflux)"; content:"|08|lifedrom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifezilla.ru (fastflux)"; content:"|09|lifezilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifoo.ru (fastflux)"; content:"|05|lifoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limon4ik.myftp.biz (malware)"; content:"|08|limon4ik|05|myftp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litmai.com (rogue)"; content:"|06|litmai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loads.fuckmoymosk.com (trojan)"; content:"|05|loads|0b|fuckmoymosk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lock-stock.jp (exploits)"; content:"|0a|lock-stock|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonelost.com (trojan)"; content:"|08|lonelost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love2coffe.cn (exploit)"; content:"|0a|love2coffe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovingmoms.net (botnet)"; content:"|0a|lovingmoms|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maghdfun.cc (malware)"; content:"|08|maghdfun|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicjoker.in (malware)"; content:"|0a|magicjoker|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaflvservice.com (trojan)"; content:"|0f|mediaflvservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediasoftplus.com (trojan)"; content:"|0d|mediasoftplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneyinfo.com (malware)"; content:"|09|moneyinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moral-theology.cn (rogue)"; content:"|0e|moral-theology|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morde.su (zeus)"; content:"|05|morde|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mroblom.ru (zbot)"; content:"|07|mroblom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaflvservice.com (trojan)"; content:"|14|multimediaflvservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediasoftmore.com (malware)"; content:"|12|multimediasoftmore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfreemov.ru (trojan)"; content:"|09|myfreemov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspace.fb-image.com (malware)"; content:"|07|myspace|08|fb-image|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nailxpert.com (rfi)"; content:"|09|nailxpert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup navigationsearch.org (malware)"; content:"|10|navigationsearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neswage.com (rogue)"; content:"|07|neswage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newminiclub.nl (rfi)"; content:"|0b|newminiclub|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nneroitt.info (luckysploit)"; content:"|08|nneroitt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnewage.com (rogue)"; content:"|07|nnewage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns-free-acc6.com (rogue)"; content:"|0c|ns-free-acc6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-bidder.com (rfi)"; content:"|0d|online-bidder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup origenalwebs.com (trojan)"; content:"|0c|origenalwebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otsmotrel.ru (rfi)"; content:"|09|otsmotrel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parikmaher.ru (rfi)"; content:"|0a|parikmaher|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pastyono.info (luckysploit)"; content:"|08|pastyono|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perreduno.info (luckysploit)"; content:"|09|perreduno|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prerre.com (waledac)"; content:"|06|prerre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup previouslife.ru (exploits)"; content:"|0c|previouslife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proanalytics.cn (exploit)"; content:"|0c|proanalytics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raktor.net (malware)"; content:"|06|raktor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup real-secure-payment.com (rogue)"; content:"|13|real-secure-payment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rescuenergy.it (zeus)"; content:"|0b|rescuenergy|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rnn.freehostia.com (zeus)"; content:"|03|rnn|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabber.info (luckysploit)"; content:"|06|sabber|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safewebway.com (rogue)"; content:"|0a|safewebway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-active-securitys.org (rogue)"; content:"|15|scan-active-securitys|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchimages.org (malware)"; content:"|0c|searchimages|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchreveals.org (malware)"; content:"|0d|searchreveals|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchthomas.org (trojan)"; content:"|0c|searchthomas|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup see-the-live-block-stats.com (phishing)"; content:"|18|see-the-live-block-stats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexypupsik.cn (zeus)"; content:"|0a|sexypupsik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik4.com (zeus)"; content:"|07|slavik4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik5.com (zeus)"; content:"|07|slavik5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slepfrend.cn (malware)"; content:"|09|slepfrend|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smert-test.ru (exploit)"; content:"|0a|smert-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solomediaonline.net (trojan)"; content:"|0f|solomediaonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solomediasite.com (trojan)"; content:"|0d|solomediasite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup some-air.com (rogue)"; content:"|08|some-air|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somesir.com (rogue)"; content:"|07|somesir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sourcemediafiles.com (trojan)"; content:"|10|sourcemediafiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space-share.net (zeus)"; content:"|0b|space-share|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spai.pt (zeus)"; content:"|04|spai|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sport-lab.cn (zbot)"; content:"|09|sport-lab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storepc.com (zbot)"; content:"|07|storepc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup student.cmsh.cyc.edu.tw (malware)"; content:"|07|student|04|cmsh|03|cyc|03|edu|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superpuperltd.com (zeus)"; content:"|0d|superpuperltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup symyho3393245.cn (malware)"; content:"|0d|symyho3393245|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-dns.net (malware)"; content:"|0a|system-dns|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testodrome.ru (exploit)"; content:"|0a|testodrome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testometr.ru (fastflux)"; content:"|09|testometr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testress.com (trojan)"; content:"|08|testress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theloandirect.biz (trojan)"; content:"|0d|theloandirect|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestatsgov.info (rogue)"; content:"|0b|thestatsgov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thyselius.tv (malware)"; content:"|09|thyselius|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typetrie.com (trojan)"; content:"|08|typetrie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typetrus.com (trojan)"; content:"|08|typetrus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typtrue.com (trojan)"; content:"|07|typtrue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubakeo.cn (exploit)"; content:"|06|ubakeo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uniqez.cn (zeus)"; content:"|06|uniqez|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unixpoint.com.br (rfi)"; content:"|09|unixpoint|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateexperiment.net (rogue)"; content:"|10|updateexperiment|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usabodyscan.com (rogue)"; content:"|0b|usabodyscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vi2tu.net (malware)"; content:"|05|vi2tu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoforamateur.ru (trojan)"; content:"|0f|videoforamateur|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vindcar.com (trojan)"; content:"|07|vindcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivilan.cn (trojan)"; content:"|07|vivilan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vty8p.cn (exploits)"; content:"|05|vty8p|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-update2010.com (www.malwaredomainlist.com/update.php)"; content:"|12|windows-update2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winguard-2009.com (rogue)"; content:"|0d|winguard-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wonderfullstuff.cn (trojan)"; content:"|0f|wonderfullstuff|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxlilly.com (malware)"; content:"|08|xxxlilly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yashi11.freehostia.com (zeus)"; content:"|07|yashi11|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youneyoum.info (luckysploit)"; content:"|09|youneyoum|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup young-in-mature.com (botnet)"; content:"|0f|young-in-mature|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youravplus.com (rogue)"; content:"|0a|youravplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytrewq.ru (malware)"; content:"|06|ytrewq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acs86.com (asprox)"; content:"|05|acs86|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0rgazmer.com (trojan)"; content:"|08|0rgazmer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2short2be.biz (trojan)"; content:"|09|2short2be|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3gsoftstore.com (rogue)"; content:"|0b|3gsoftstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3k70.cn (exploit)"; content:"|04|3k70|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3lines.by.ru (exploit)"; content:"|06|3lines|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 70sp.co.cc (exploit)"; content:"|04|70sp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 777yo777.cn (zeus)"; content:"|08|777yo777|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8000msn.cn (trojan)"; content:"|07|8000msn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activelayersecurity.cn (rogue)"; content:"|13|activelayersecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritygates.cn (rogue)"; content:"|13|activesecuritygates|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritylivepro.org (rogue)"; content:"|15|activesecuritylivepro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeomailer023.com (fastflux)"; content:"|0c|aeomailer023|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aikyu.ru (fastflux)"; content:"|05|aikyu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-security0.com (scareware)"; content:"|0d|all-security0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-security9.com (scareware)"; content:"|0d|all-security9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allsecuritysoft.com (rogue)"; content:"|0f|allsecuritysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allvermarket.com (rogue)"; content:"|0c|allvermarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amentia.by.ru (exploit)"; content:"|07|amentia|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anobhwalukager.com (Rogue)"; content:"|0e|anobhwalukager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusstock.com (scareware)"; content:"|0e|antivirusstock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b-i-o-v.ru (fastflux)"; content:"|07|b-i-o-v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected6.com (scareware)"; content:"|0d|be-protected6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestwaytoscanz.com (scareware)"; content:"|0e|bestwaytoscanz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup big-dick.ru (directs)"; content:"|08|big-dick|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigsald.com (Trojan)"; content:"|07|bigsald|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigxale.com (Trojan)"; content:"|07|bigxale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bilgiseldershanesi.com (exploit)"; content:"|12|bilgiseldershanesi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockprotector.com (scareware)"; content:"|0e|blockprotector|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bnewage.com (rogue)"; content:"|07|bnewage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boqeouti.org (rootkit)"; content:"|08|boqeouti|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandine.com (exploits)"; content:"|08|brandine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cahyvil.com (fastflux)"; content:"|07|cahyvil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinaoilfactory.cn (zeus)"; content:"|0f|chinaoilfactory|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ck47hfu.cn (zeus)"; content:"|07|ck47hfu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup closstab.com (rogue)"; content:"|08|closstab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coantivirus.com (scareware)"; content:"|0b|coantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colopin.cn (zeus)"; content:"|07|colopin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counterweb.cn (trojan)"; content:"|0a|counterweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cryaboutmeasure.su (trojan)"; content:"|0f|cryaboutmeasure|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dallynews.cn (malware)"; content:"|09|dallynews|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datamaxstore.com (rogue)"; content:"|0c|datamaxstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dazinfo.com (exploit)"; content:"|07|dazinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaaf.co.uk (malspam)"; content:"|06|deaaaf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaaf.me.uk (malspam)"; content:"|06|deaaaf|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaaf.org.uk (malspam)"; content:"|06|deaaaf|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaag.me.uk (malspam)"; content:"|06|deaaag|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaag.org.uk (malspam)"; content:"|06|deaaag|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaas.me.uk (malspam)"; content:"|06|deaaas|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaaas.org.uk (malspam)"; content:"|06|deaaas|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedlife.ru (fastflux)"; content:"|07|dedlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devi56.co.cc (zeus)"; content:"|06|devi56|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digital-ist-individueller.de (zeus)"; content:"|19|digital-ist-individueller|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup direct-antivirus.com (scareware)"; content:"|10|direct-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dom0cn.cn (trojan)"; content:"|06|dom0cn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dom1cn.cn (trojan)"; content:"|06|dom1cn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dom2cn.cn (exploit)"; content:"|06|dom2cn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domx2.cn (exploit)"; content:"|05|domx2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doublenk.com (scareware)"; content:"|08|doublenk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doublenuks.com (scareware)"; content:"|0a|doublenuks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dovzyag.cn (Rogue)"; content:"|07|dovzyag|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dox1.cn (trojan)"; content:"|04|dox1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dox2.cn (trojan)"; content:"|04|dox2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dox3.cn (trojan)"; content:"|04|dox3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dozabes.cn (Rogue)"; content:"|07|dozabes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup droplapstill.net (rogue)"; content:"|0c|droplapstill|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ducyqan.cn (Rogue)"; content:"|07|ducyqan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duzebyn.cn (Rogue)"; content:"|07|duzebyn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dybapi.cn (Rogue)"; content:"|06|dybapi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elltime.com (Trojan)"; content:"|07|elltime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enkafuulgeskohuj.com (Rogue)"; content:"|10|enkafuulgeskohuj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epuneyv.cn (Rogue)"; content:"|07|epuneyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epuvyiz.cn (Rogue)"; content:"|07|epuvyiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erstugaskedumil.com (Rogue)"; content:"|0f|erstugaskedumil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertadbuferytagol.com (Rogue)"; content:"|10|ertadbuferytagol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertidonaferdogalo.com (Rogue)"; content:"|11|ertidonaferdogalo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertu6naygertos.com (Rogue)"; content:"|0e|ertu6naygertos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everystat.cn (zeus)"; content:"|09|everystat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everytimewetouch.biz (zeus)"; content:"|10|everytimewetouch|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exponentials.cn (rogue)"; content:"|0c|exponentials|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fd5a.cn (malware)"; content:"|04|fd5a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdoublenuk.com (rogue)"; content:"|0a|fdoublenuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findmultiple.org (trojan)"; content:"|0c|findmultiple|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivefilesmarket.com (rogue)"; content:"|0f|fivefilesmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemediaform.com (trojan)"; content:"|0d|freemediaform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freenstar.com (Trojan)"; content:"|09|freenstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g-antivirus.com (Rogue)"; content:"|0b|g-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamerszons.cn (rootkit)"; content:"|0a|gamerszons|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamescoresite.net (zeus)"; content:"|0d|gamescoresite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ge-t.ru (fastflux)"; content:"|04|ge-t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-av.com (scareware)"; content:"|0a|general-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generalavs.com (Rogue)"; content:"|0a|generalavs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genesis-market.com (rogue)"; content:"|0e|genesis-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-secure2.com (scareware)"; content:"|0b|get-secure2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get2.tv (rogue)"; content:"|04|get2|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmyprotection1.com (scareware)"; content:"|10|getmyprotection1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godtrafmar.com (trojan)"; content:"|0a|godtrafmar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golookscan.com (rogue)"; content:"|0a|golookscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good412.net (zeus)"; content:"|07|good412|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiypfisetn.com (exploits)"; content:"|0a|hiypfisetn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdembloger.com (malware)"; content:"|0c|holdembloger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup home.bangkok.th.com (zeus)"; content:"|04|home|07|bangkok|02|th|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtosecurea.com (rogue)"; content:"|0c|howtosecurea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iftwall.com (rogue)"; content:"|07|iftwall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igt-groupco.cn (moneymule)"; content:"|0b|igt-groupco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igt-groupinc.com (moneymule)"; content:"|0c|igt-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igtgroupinc.cn (moneymule)"; content:"|0b|igtgroupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolii.co.uk (malspam)"; content:"|06|iiolii|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolii.me.uk (malspam)"; content:"|06|iiolii|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolii.org.uk (malspam)"; content:"|06|iiolii|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolik.co.uk (malspam)"; content:"|06|iiolik|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolik.me.uk (malspam)"; content:"|06|iiolik|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolik.org.uk (malspam)"; content:"|06|iiolik|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolio.co.uk (malspam)"; content:"|06|iiolio|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolio.me.uk (malspam)"; content:"|06|iiolio|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiolio.org.uk (malspam)"; content:"|06|iiolio|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iioliu.co.uk (malspam)"; content:"|06|iioliu|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iioliu.me.uk (malspam)"; content:"|06|iioliu|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iioliu.org.uk (malspam)"; content:"|06|iioliu|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup images-dns.com (exploit)"; content:"|0a|images-dns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup implementmultimedia.net (rogue)"; content:"|13|implementmultimedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup index-groupinc.cn (moneymule)"; content:"|0e|index-groupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup index-groupinc.com (moneymule)"; content:"|0e|index-groupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup index-groupmain.cn (moneymule)"; content:"|0f|index-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indexgroupinc.net (moneymule)"; content:"|0d|indexgroupinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ing-groupsvc.cn (moneymule)"; content:"|0c|ing-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insorg.biz (exploit)"; content:"|06|insorg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup installprotection2.com (scareware)"; content:"|12|installprotection2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujef.co.uk (malspam)"; content:"|08|iuuuujef|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujef.me.uk (malspam)"; content:"|08|iuuuujef|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujef.org.uk (malspam)"; content:"|08|iuuuujef|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujeg.co.uk (malspam)"; content:"|08|iuuuujeg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujeg.me.uk (malspam)"; content:"|08|iuuuujeg|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujeg.org.uk (malspam)"; content:"|08|iuuuujeg|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujek.co.uk (malspam)"; content:"|08|iuuuujek|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujek.me.uk (malspam)"; content:"|08|iuuuujek|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujek.org.uk (malspam)"; content:"|08|iuuuujek|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujer.co.uk (malspam)"; content:"|08|iuuuujer|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuuuujer.me.uk (malspam)"; content:"|08|iuuuujer|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabdata1.com (zeus)"; content:"|08|jabdata1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhsbvd67fdkj.com (zeus)"; content:"|0c|jhsbvd67fdkj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhvds786dsmg.com (zeus)"; content:"|0c|jhvds786dsmg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmpads.com (malspam)"; content:"|06|jmpads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karginn.sytes.net (zeus)"; content:"|07|karginn|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keholope.cn (zeus)"; content:"|08|keholope|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyod.biz (zeus)"; content:"|04|kyod|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labnolsoftware.com (rogue)"; content:"|0e|labnolsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lawsons.co.za (exploits)"; content:"|07|lawsons|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liftven.com (Rogue)"; content:"|07|liftven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-counter.info (exploit)"; content:"|0c|live-counter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonazq.eu (zeus)"; content:"|06|lonazq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonazt.eu (zeus)"; content:"|06|lonazt|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonazv.eu (zeus)"; content:"|06|lonazv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonazz.eu (zeus)"; content:"|06|lonazz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loopsoftmarket.com (rogue)"; content:"|0e|loopsoftmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luflat.com (Trojan)"; content:"|06|luflat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macatte.com (Rogue)"; content:"|07|macatte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup master-groupinc.org (moneymule)"; content:"|0f|master-groupinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup master-groupsvc.cn (moneymule)"; content:"|0f|master-groupsvc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastergroupinc.cn (moneymule)"; content:"|0e|mastergroupinc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-bounty-block-checker.com (phishing)"; content:"|18|max-bounty-block-checker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxxdrugstore.com (exploits)"; content:"|0d|maxxdrugstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mellis-group.cn (moneymule)"; content:"|0c|mellis-group|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mellis-groupmain.cn (moneymule)"; content:"|10|mellis-groupmain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mgoogle.biz (zeus)"; content:"|07|mgoogle|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mioanalitic.in (exploit)"; content:"|0b|mioanalitic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirroronerotwo.com (exploit)"; content:"|0e|mirroronerotwo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monoreg.com (trojan)"; content:"|07|monoreg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-protection1.com (scareware)"; content:"|0e|my-protection1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspace-files.com (malspam)"; content:"|0d|myspace-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanosoftwarecart.com (rogue)"; content:"|10|nanosoftwarecart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-hou.sun-inet.or.jp (exploit)"; content:"|07|net-hou|08|sun-inet|02|or|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netsuitemarket.com (rogue)"; content:"|0e|netsuitemarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoff.net (exploit)"; content:"|07|newsoff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nigsale.com (Trojan)"; content:"|07|nigsale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmtechmarket.com (rogue)"; content:"|0c|nmtechmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt202.cn (trojan)"; content:"|05|nt202|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nysoftstore.com (rogue)"; content:"|0b|nysoftstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup offnews.cn (exploit)"; content:"|07|offnews|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okto-systems.com (exploit)"; content:"|0c|okto-systems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oliftben.com (rogue)"; content:"|08|oliftben|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurebill.net (rogue)"; content:"|10|onlinesecurebill|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlyfreeoffersonline.com (malspam)"; content:"|14|onlyfreeoffersonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openhouseinspect.com (malware)"; content:"|10|openhouseinspect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opifdngm.info (malspam)"; content:"|08|opifdngm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panchungpatwotong.com (malware)"; content:"|11|panchungpatwotong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdgsoftstore.com (rogue)"; content:"|0c|pdgsoftstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoenix-groupco.net (moneymule)"; content:"|0f|phoenix-groupco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pick-blocked-buddies.com (malware)"; content:"|14|pick-blocked-buddies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promed-net.com (zeus)"; content:"|0a|promed-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualitysoftonline.com (rogue)"; content:"|11|qualitysoftonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicksoftwarecart.com (rogue)"; content:"|11|quicksoftwarecart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rayahari.net (hacking)"; content:"|08|rayahari|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sboxopa.awecomsandbox.com (zeus)"; content:"|07|sboxopa|0d|awecomsandbox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-free.com (scareware)"; content:"|0c|scanner-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scansecurityhole.cn (rogue)"; content:"|10|scansecurityhole|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scorptechstore.com (rogue)"; content:"|0e|scorptechstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setclit.com (Trojan)"; content:"|07|setclit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setxlif.com (Trojan)"; content:"|07|setxlif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexyteengallery.cn (exploit)"; content:"|0f|sexyteengallery|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sick-frost.com (trojan)"; content:"|0a|sick-frost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sites-counter.com (harmful)"; content:"|0d|sites-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartwinmarket.com (rogue)"; content:"|0e|smartwinmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sml-market.com (rogue)"; content:"|0a|sml-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareclean0.com (scareware)"; content:"|0d|spywareclean0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareclean3.com (scareware)"; content:"|0d|spywareclean3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sstewart1ew.tripod.com (zeus)"; content:"|0b|sstewart1ew|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stevebasu.net (zeus)"; content:"|09|stevebasu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superkahn.ru (fastflux)"; content:"|09|superkahn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersidecar.ru (fastflux)"; content:"|0c|supersidecar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sutra-traffic.com (exploit)"; content:"|0d|sutra-traffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemfighter.com (Rogue)"; content:"|0d|systemfighter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemveteran.com (rogue)"; content:"|0d|systemveteran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup szickfrost.com (trojan)"; content:"|0a|szickfrost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tavakulio5nktab.com (Rogue)"; content:"|0f|tavakulio5nktab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testoid.ru (fastflux)"; content:"|07|testoid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-oratory.org (rogue)"; content:"|0b|the-oratory|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-previous-life.ru (fastflux)"; content:"|11|the-previous-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tigriona.by.ru (exploits)"; content:"|08|tigriona|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficfromtwitter.info (trojan)"; content:"|12|trafficfromtwitter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafm.cn (zeus)"; content:"|05|trafm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treeful.com (zeus)"; content:"|07|treeful|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttesza.co.uk (malspam)"; content:"|06|ttesza|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttesza.org.uk (malspam)"; content:"|06|ttesza|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszf.co.uk (malspam)"; content:"|06|tteszf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszf.me.uk (malspam)"; content:"|06|tteszf|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszf.org.uk (malspam)"; content:"|06|tteszf|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszg.co.uk (malspam)"; content:"|06|tteszg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszg.me.uk (malspam)"; content:"|06|tteszg|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszg.org.uk (malspam)"; content:"|06|tteszg|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszk.co.uk (malspam)"; content:"|06|tteszk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszk.me.uk (malspam)"; content:"|06|tteszk|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tteszk.org.uk (malspam)"; content:"|06|tteszk|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubanergdavjaf.com (Rogue)"; content:"|0e|tubanergdavjaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutablb.cn (exploit)"; content:"|07|tutablb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twilight-garden.com (zeus)"; content:"|0f|twilight-garden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7d.eu (zeus)"; content:"|07|ujhuy7d|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7e.eu (zeus)"; content:"|07|ujhuy7e|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7f.eu (zeus)"; content:"|07|ujhuy7f|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7k.eu (zeus)"; content:"|07|ujhuy7k|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7l.eu (zeus)"; content:"|07|ujhuy7l|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7m.eu (zeus)"; content:"|07|ujhuy7m|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7n.eu (zeus)"; content:"|07|ujhuy7n|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7p.eu (zeus)"; content:"|07|ujhuy7p|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7t.eu (zeus)"; content:"|07|ujhuy7t|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujhuy7u.eu (zeus)"; content:"|07|ujhuy7u|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultrapay.net (malware)"; content:"|08|ultrapay|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtualeanalitic.in (exploit)"; content:"|10|virtualeanalitic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vredrikupop.com (exploit)"; content:"|0b|vredrikupop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vseseriozno.cn (exploit)"; content:"|0b|vseseriozno|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w6mail.info (zeus)"; content:"|06|w6mail|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whelectronics.com (exploits)"; content:"|0d|whelectronics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-guard2009.com (scareware)"; content:"|0d|win-guard2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wissneswertes.com (zeus)"; content:"|0d|wissneswertes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldrat.ru (exploit)"; content:"|08|worldrat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourdesignservices.com (exploits)"; content:"|12|yourdesignservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuki-takase.com (exploits)"; content:"|0b|yuki-takase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuj.co.uk (malspam)"; content:"|07|yyyyiuj|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuj.me.uk (malspam)"; content:"|07|yyyyiuj|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuj.org.uk (malspam)"; content:"|07|yyyyiuj|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuk.co.uk (malspam)"; content:"|07|yyyyiuk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuk.me.uk (malspam)"; content:"|07|yyyyiuk|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuk.org.uk (malspam)"; content:"|07|yyyyiuk|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuo.co.uk (malspam)"; content:"|07|yyyyiuo|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuo.me.uk (malspam)"; content:"|07|yyyyiuo|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiuo.org.uk (malspam)"; content:"|07|yyyyiuo|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiur.co.uk (malspam)"; content:"|07|yyyyiur|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiur.me.uk (malspam)"; content:"|07|yyyyiur|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyyiur.org.uk (malspam)"; content:"|07|yyyyiur|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winifixer.com (harmful)"; content:"|09|winifixer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123123k.cn (malware)"; content:"|07|123123k|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 17xmm.info (malware)"; content:"|05|17xmm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1job1.cn (zeus)"; content:"|05|1job1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1protectthispc.com (rogue)"; content:"|0e|1protectthispc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4-computer.com (rogue)"; content:"|0a|4-computer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51she.info (malware)"; content:"|05|51she|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 58sese.com (malware)"; content:"|06|58sese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 592lv.cn (malware)"; content:"|05|592lv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 61wg.com (malware)"; content:"|04|61wg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 91rpp.com (malware)"; content:"|05|91rpp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 97feihu.com (malware)"; content:"|07|97feihu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdata1.com (zeus)"; content:"|07|abdata1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acha.org.fffazsf.org.uk (malspam)"; content:"|04|acha|03|org|07|fffazsf|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritycard.cn (rogue)"; content:"|12|activesecuritycard|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritycodes.cn (rogue)"; content:"|13|activesecuritycodes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritytool.cn (rogue)"; content:"|12|activesecuritytool|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecurityzones.cn (rogue)"; content:"|13|activesecurityzones|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admzjyda.biz (ozdok)"; content:"|08|admzjyda|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajzplrakzui.org (ozdok)"; content:"|0b|ajzplrakzui|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfaharpun.org (ozdok)"; content:"|0a|alfaharpun|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altmaforbetchrono00000.info (zeus)"; content:"|16|altmaforbetchrono00000|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altmaforbetchrono00000.net (zeus)"; content:"|16|altmaforbetchrono00000|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-spyware24.com (rogue)"; content:"|0e|anti-spyware24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-spywarecenter.com (rogue)"; content:"|12|anti-spywarecenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-spywarenet.com (rogue)"; content:"|0f|anti-spywarenet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiaid.com (rogue)"; content:"|07|antiaid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispycenter.com (rogue)"; content:"|0d|antispycenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaretop.com (rogue)"; content:"|0e|antispywaretop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyworldwide.com (rogue)"; content:"|10|antispyworldwide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivaprof2009.com (exploit)"; content:"|0e|antivaprof2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviraprof2009.com (rogue)"; content:"|10|antiviraprof2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusj.com (rogue)"; content:"|0a|antivirusj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusk.com (fakeav)"; content:"|0a|antivirusk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusm.com (rogue)"; content:"|0a|antivirusm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusn.com (rogue)"; content:"|0a|antivirusn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aproximosstyle0112.info (zeus)"; content:"|12|aproximosstyle0112|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asqwazr.eu (phishing)"; content:"|07|asqwazr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automaticauto.ro (zeus)"; content:"|0d|automaticauto|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviso.ci (zeus)"; content:"|05|aviso|02|ci"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bebiland.com (zeus)"; content:"|08|bebiland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispysoft.com (rogue)"; content:"|0f|bestantispysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestvirusidentify.com (rogue)"; content:"|11|bestvirusidentify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beztakrezt.info (ozdok)"; content:"|0a|beztakrezt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billibonskanzas.com (ozdok)"; content:"|0f|billibonskanzas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blagoinc.info (ozdok)"; content:"|08|blagoinc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blockdefender.com (rogue)"; content:"|0d|blockdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobo555.net (malware)"; content:"|07|bobo555|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombermans.cn (trojan)"; content:"|0a|bombermans|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookheads.cn (zeus)"; content:"|09|bookheads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brasilive.vai.la (malware)"; content:"|09|brasilive|03|vai|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdarwash.com (fakeav)"; content:"|08|cdarwash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cristymisty.info (ozdok)"; content:"|0b|cristymisty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkpieces.com (zeus)"; content:"|0a|darkpieces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davtraff.com (exploit)"; content:"|08|davtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devline.se (koobface)"; content:"|07|devline|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dilokqm.eu (phishing)"; content:"|07|dilokqm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssad.co.uk (phish)"; content:"|08|eeejssad|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssad.me.uk (phish)"; content:"|08|eeejssad|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssad.org.uk (phish)"; content:"|08|eeejssad|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssaf.co.uk (phish)"; content:"|08|eeejssaf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssaf.me.uk (phish)"; content:"|08|eeejssaf|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssaf.org.uk (phish)"; content:"|08|eeejssaf|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssah.co.uk (phish)"; content:"|08|eeejssah|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssah.me.uk (phish)"; content:"|08|eeejssah|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssah.org.uk (phish)"; content:"|08|eeejssah|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssaw.me.uk (phish)"; content:"|08|eeejssaw|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eeejssaw.org.uk (phish)"; content:"|08|eeejssaw|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1ua.eu (botnet)"; content:"|07|eiye1ua|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1uc.eu (botnet)"; content:"|07|eiye1uc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1ue.eu (botnet)"; content:"|07|eiye1ue|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1uf.eu (botnet)"; content:"|07|eiye1uf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1ug.eu (botnet)"; content:"|07|eiye1ug|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1ur.eu (botnet)"; content:"|07|eiye1ur|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1us.eu (botnet)"; content:"|07|eiye1us|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1ut.eu (botnet)"; content:"|07|eiye1ut|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiye1uv.eu (botnet)"; content:"|07|eiye1uv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enzyman.com (botnet)"; content:"|07|enzyman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wb.eu (phishing)"; content:"|08|ersd12wb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wc.eu (phishing)"; content:"|08|ersd12wc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wg.eu (phishing)"; content:"|08|ersd12wg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wh.eu (phishing)"; content:"|08|ersd12wh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wj.eu (phishing)"; content:"|08|ersd12wj|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wk.eu (phishing)"; content:"|08|ersd12wk|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wl.eu (phishing)"; content:"|08|ersd12wl|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wm.eu (phishing)"; content:"|08|ersd12wm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wo.eu (phishing)"; content:"|08|ersd12wo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wv.eu (phishing)"; content:"|08|ersd12wv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersd12wy.eu (phishing)"; content:"|08|ersd12wy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazab.eu (botnet)"; content:"|07|fasazab|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazad.eu (botnet)"; content:"|07|fasazad|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazae.eu (botnet)"; content:"|07|fasazae|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazaf.eu (botnet)"; content:"|07|fasazaf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazag.eu (botnet)"; content:"|07|fasazag|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazam.eu (botnet)"; content:"|07|fasazam|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasazav.eu (botnet)"; content:"|07|fasazav|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-zonescannow.com (rogue)"; content:"|10|fast-zonescannow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-zonescannow.net (rogue)"; content:"|10|fast-zonescannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastzone-scannow.com (rogue)"; content:"|10|fastzone-scannow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastzone-scannow.net (rogue)"; content:"|10|fastzone-scannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastzonescan-now.com (rogue)"; content:"|10|fastzonescan-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastzonescannow.com (rogue)"; content:"|0f|fastzonescannow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastzonescannow.net (rogue)"; content:"|0f|fastzonescannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foodcaters.info (ozdok)"; content:"|0a|foodcaters|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fouineur.net (zeus)"; content:"|08|fouineur|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxyfis.com (trojan)"; content:"|07|foxyfis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galileoboots.info (ozdok)"; content:"|0c|galileoboots|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geld-bonis.de (zeus)"; content:"|0a|geld-bonis|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggv.nna.cc (malware)"; content:"|03|ggv|03|nna|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-certificates.net (zeus)"; content:"|13|global-certificates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gobarscan.com (rogue)"; content:"|09|gobarscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gondolfrazrv3.com (ozdok)"; content:"|0d|gondolfrazrv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatpunnett.com (ozdok)"; content:"|0c|greatpunnett|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-av-2010-pro.com (rogue)"; content:"|11|green-av-2010-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gretdinner.com (fakescanner)"; content:"|0a|gretdinner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grezasadaf.info (ozdok)"; content:"|0a|grezasadaf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guidetosecurity3.com (rogue)"; content:"|10|guidetosecurity3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hakasimq.info (ozdok)"; content:"|08|hakasimq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hcardoso.com (zeus)"; content:"|08|hcardoso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsb.eu (phish)"; content:"|07|heratsb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsd.eu (phish)"; content:"|07|heratsd|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsf.eu (phish)"; content:"|07|heratsf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsg.eu (phish)"; content:"|07|heratsg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsh.eu (phish)"; content:"|07|heratsh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsk.eu (phish)"; content:"|07|heratsk|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsl.eu (phish)"; content:"|07|heratsl|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsm.eu (phish)"; content:"|07|heratsm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsn.eu (phish)"; content:"|07|heratsn|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratso.eu (phishing)"; content:"|07|heratso|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsq.eu (phish)"; content:"|07|heratsq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsr.eu (phish)"; content:"|07|heratsr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratss.eu (phish)"; content:"|07|heratss|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratst.eu (phish)"; content:"|07|heratst|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heratsy.eu (phish)"; content:"|07|heratsy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzd.eu (botnet)"; content:"|08|herrazzd|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzh.eu (botnet)"; content:"|08|herrazzh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzj.eu (botnet)"; content:"|08|herrazzj|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzo.eu (botnet)"; content:"|08|herrazzo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzr.eu (botnet)"; content:"|08|herrazzr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herrazzy.eu (botnet)"; content:"|08|herrazzy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotopikalar.info (ozdok)"; content:"|0b|hotopikalar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtoprotect1.com (rogue)"; content:"|0d|howtoprotect1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibbaswze.eu (botnet)"; content:"|08|ibbaswze|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioooliob.eu (phish)"; content:"|08|ioooliob|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolioc.eu (phish)"; content:"|08|iooolioc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolioe.eu (phishing)"; content:"|08|iooolioe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioooliog.eu (phish)"; content:"|08|ioooliog|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolioq.eu (phish)"; content:"|08|iooolioq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolior.eu (phish)"; content:"|08|iooolior|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolios.eu (phish)"; content:"|08|iooolios|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioooliot.eu (phish)"; content:"|08|ioooliot|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioooliov.eu (phishing)"; content:"|08|ioooliov|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioooliox.eu (phish)"; content:"|08|ioooliox|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iooolioy.eu (phishing)"; content:"|08|iooolioy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iztep14mrkde.info (ozdok)"; content:"|0c|iztep14mrkde|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamfzuyqyra.com (ozdok)"; content:"|0b|jamfzuyqyra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jopiterazania.net (ozdok)"; content:"|0d|jopiterazania|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup judlife.com (malware)"; content:"|07|judlife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabinaout.net (zeus)"; content:"|09|kabinaout|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kampfish.com (trojan)"; content:"|08|kampfish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kavymsu.cn (rogue)"; content:"|07|kavymsu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kerleymira.com (zeus)"; content:"|0a|kerleymira|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-virusb.com (rogue)"; content:"|0b|kill-virusb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-virusc.com (rogue)"; content:"|0b|kill-virusc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-virusd.com (rogue)"; content:"|0b|kill-virusd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiniop.cn (zeus)"; content:"|06|kiniop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuport.com (ozdok)"; content:"|06|kuport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakpfish.com (trojan)"; content:"|08|lakpfish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup learnherenow.com (zeus)"; content:"|0c|learnherenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lef1asza.eu (botnet)"; content:"|08|lef1asza|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefassza.eu (botnet)"; content:"|08|lefassza|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefaszan.eu (botnet)"; content:"|08|lefaszan|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefaszav.eu (botnet)"; content:"|08|lefaszav|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefaszxa.eu (botnet)"; content:"|08|lefaszxa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefawsza.eu (botnet)"; content:"|08|lefawsza|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiob.eu (phish)"; content:"|08|lllujiob|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioc.eu (phish)"; content:"|08|lllujioc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiod.eu (phish)"; content:"|08|lllujiod|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiof.eu (phish)"; content:"|08|lllujiof|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiog.eu (phish)"; content:"|08|lllujiog|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioh.eu (phish)"; content:"|08|lllujioh|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioi.eu (phish)"; content:"|08|lllujioi|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioj.eu (phish)"; content:"|08|lllujioj|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujion.eu (phish)"; content:"|08|lllujion|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiot.eu (phish)"; content:"|08|lllujiot|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiov.eu (phish)"; content:"|08|lllujiov|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujiox.eu (phish)"; content:"|08|lllujiox|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioy.eu (phish)"; content:"|08|lllujioy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lllujioz.eu (phish)"; content:"|08|lllujioz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovingliferetreats.com (threat)"; content:"|12|lovingliferetreats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malicious-sites.com (rogue)"; content:"|0f|malicious-sites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwardetect.com (fakescanner)"; content:"|0c|malwardetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketingtechnologymaven.com (zeus)"; content:"|18|marketingtechnologymaven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazerattikrak.info (ozdok)"; content:"|0d|mazerattikrak|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metrobrokerage.com (phish)"; content:"|0e|metrobrokerage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbad.co.uk (botnet)"; content:"|07|mibbbad|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbad.me.uk (botnet)"; content:"|07|mibbbad|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbad.org.uk (botnet)"; content:"|07|mibbbad|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbah.co.uk (botnet)"; content:"|07|mibbbah|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbah.me.uk (botnet)"; content:"|07|mibbbah|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbah.org.uk (botnet)"; content:"|07|mibbbah|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbal.co.uk (botnet)"; content:"|07|mibbbal|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibbbal.me.uk (botnet)"; content:"|07|mibbbal|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micralokp.biz (ozdok)"; content:"|09|micralokp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milfifezaboq.org (ozdok)"; content:"|0c|milfifezaboq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miraklegroup.info (ozdok)"; content:"|0c|miraklegroup|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirexint.biz (ozdok)"; content:"|08|mirexint|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mkzyajiujoiq.info (ozdok)"; content:"|0c|mkzyajiujoiq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nayzielzp.biz (ozdok)"; content:"|09|nayzielzp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeaza.co.uk (phish)"; content:"|07|neeeaza|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeaza.me.uk (phish)"; content:"|07|neeeaza|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeaza.org.uk (phish)"; content:"|07|neeeaza|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazd.co.uk (phish)"; content:"|07|neeeazd|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazd.me.uk (phish)"; content:"|07|neeeazd|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazd.org.uk (phish)"; content:"|07|neeeazd|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazg.co.uk (phish)"; content:"|07|neeeazg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazg.me.uk (phish)"; content:"|07|neeeazg|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazg.org.uk (phish)"; content:"|07|neeeazg|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazh.co.uk (phish)"; content:"|07|neeeazh|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazh.me.uk (phish)"; content:"|07|neeeazh|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazh.org.uk (phish)"; content:"|07|neeeazh|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazk.co.uk (phish)"; content:"|07|neeeazk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazk.me.uk (phish)"; content:"|07|neeeazk|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeeazk.org.uk (phish)"; content:"|07|neeeazk|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nutua.com (malware)"; content:"|05|nutua|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olampfish.com (trojan)"; content:"|09|olampfish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinegazik.name (zeus)"; content:"|0b|onlinegazik|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oooeasef.eu (botnet)"; content:"|08|oooeasef|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oooeaseg.eu (botnet)"; content:"|08|oooeaseg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-safe2009.com (rogue)"; content:"|0b|pc-safe2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcdoctor2010.com (rogue)"; content:"|0c|pcdoctor2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprotect2009.com (rogue)"; content:"|0d|pcprotect2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsafety2009.com (rogue)"; content:"|0c|pcsafety2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsafetyonline.com (rogue)"; content:"|0e|pcsafetyonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pilimerkazana.biz (ozdok)"; content:"|0d|pilimerkazana|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poelzmdayl.com (ozdok)"; content:"|0a|poelzmdayl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawe.eu (botnet)"; content:"|08|poresawe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawg.eu (botnet)"; content:"|08|poresawg|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawq.eu (botnet)"; content:"|08|poresawq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawu.eu (botnet)"; content:"|08|poresawu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawv.eu (botnet)"; content:"|08|poresawv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresawx.eu (botnet)"; content:"|08|poresawx|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvcox.biz (zeus)"; content:"|05|pvcox|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasc.eu (botnet)"; content:"|07|qqqqasc|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasf.eu (botnet)"; content:"|07|qqqqasf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqash.eu (botnet)"; content:"|07|qqqqash|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasj.eu (botnet)"; content:"|07|qqqqasj|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqask.eu (botnet)"; content:"|07|qqqqask|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasl.eu (botnet)"; content:"|07|qqqqasl|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqaso.eu (botnet)"; content:"|07|qqqqaso|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasr.eu (botnet)"; content:"|07|qqqqasr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqqasy.eu (botnet)"; content:"|07|qqqqasy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raffaellopaolino.net (ozdok)"; content:"|10|raffaellopaolino|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rainbowlike.cn (malware)"; content:"|0b|rainbowlike|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resonabhuy.kz (ozdok)"; content:"|0a|resonabhuy|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzask.co.uk (botnet)"; content:"|07|saxzask|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzask.me.uk (botnet)"; content:"|07|saxzask|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzask.org.uk (botnet)"; content:"|07|saxzask|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasl.co.uk (botnet)"; content:"|07|saxzasl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasl.me.uk (botnet)"; content:"|07|saxzasl|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasl.org.uk (botnet)"; content:"|07|saxzasl|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasv.co.uk (botnet)"; content:"|07|saxzasv|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasv.me.uk (botnet)"; content:"|07|saxzasv|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasv.org.uk (botnet)"; content:"|07|saxzasv|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saxzasy.co.uk (botnet)"; content:"|07|saxzasy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawf.co.uk (botnet)"; content:"|07|sazzawf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawf.eu (botnet)"; content:"|07|sazzawf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawf.me.uk (botnet)"; content:"|07|sazzawf|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawk.co.uk (botnet)"; content:"|07|sazzawk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawk.me.uk (botnet)"; content:"|07|sazzawk|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sazzawl.co.uk (botnet)"; content:"|07|sazzawl|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerg.com (rogue)"; content:"|08|scannerg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerh.com (rogue)"; content:"|08|scannerh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerr.com (rogue)"; content:"|08|scannerr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-me0.com (rogue)"; content:"|0a|secure-me0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekprotection2009.com (rogue)"; content:"|12|seekprotection2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shieldsafeness.com (rogue)"; content:"|0e|shieldsafeness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidlife.com (rogue)"; content:"|07|sidlife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skiloper.net (ozdok)"; content:"|08|skiloper|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slides.whyza.net (malware)"; content:"|06|slides|05|whyza|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallcyclades.com (zeus)"; content:"|0d|smallcyclades|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socks5servise.cn (zeus)"; content:"|0d|socks5servise|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softbarrier.com (rogue)"; content:"|0b|softbarrier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softstronghold.com (rogue)"; content:"|0e|softstronghold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spirina.by.ru (malware)"; content:"|07|spirina|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spydetect2009.com (rogue)"; content:"|0d|spydetect2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-list.com (rogue)"; content:"|0c|spyware-list|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaredetector24.com (rogue)"; content:"|11|spywaredetector24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarescani.com (rogue)"; content:"|0c|spywarescani|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superactivesecurity.cn (rogue)"; content:"|13|superactivesecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syrus.x10hosting.com (zeus)"; content:"|05|syrus|0a|x10hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemwarrior.com (rogue)"; content:"|0d|systemwarrior|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tb-media-shop.de (zeus)"; content:"|0d|tb-media-shop|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trollgold.info (zeus)"; content:"|09|trollgold|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteraa.eu (phish)"; content:"|07|ttteraa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterab.eu (phish)"; content:"|07|ttterab|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterac.eu (phish)"; content:"|07|ttterac|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterad.eu (phish)"; content:"|07|ttterad|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterae.eu (phish)"; content:"|07|ttterae|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteraf.eu (phish)"; content:"|07|ttteraf|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterag.eu (phish)"; content:"|07|ttterag|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteran.eu (phish)"; content:"|07|ttteran|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteraq.eu (phish)"; content:"|07|ttteraq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteras.eu (phishing)"; content:"|07|ttteras|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterat.eu (phishing)"; content:"|07|ttterat|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterav.eu (phish)"; content:"|07|ttterav|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttterax.eu (phish)"; content:"|07|ttterax|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttteraz.eu (phish)"; content:"|07|ttteraz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typekn.com (trojan)"; content:"|06|typekn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typirew.org (ozdok)"; content:"|07|typirew|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tytpein.com (trojan)"; content:"|07|tytpein|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uffertyew.cn (zeus)"; content:"|09|uffertyew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uikkl.info (ozdok)"; content:"|05|uikkl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaq1.co.uk (phishing)"; content:"|08|ujtqwaq1|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaq1.eu (phish)"; content:"|08|ujtqwaq1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaq1.me.uk (phishing)"; content:"|08|ujtqwaq1|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaq1.org.uk (phishing)"; content:"|08|ujtqwaq1|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqb.co.uk (phishing)"; content:"|08|ujtqwaqb|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqb.eu (phish)"; content:"|08|ujtqwaqb|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqb.me.uk (phishing)"; content:"|08|ujtqwaqb|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqb.org.uk (phishing)"; content:"|08|ujtqwaqb|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqk.co.uk (phishing)"; content:"|08|ujtqwaqk|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqk.eu (phishing)"; content:"|08|ujtqwaqk|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqk.me.uk (phishing)"; content:"|08|ujtqwaqk|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqk.org.uk (phishing)"; content:"|08|ujtqwaqk|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqm.co.uk (phishing)"; content:"|08|ujtqwaqm|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqm.eu (phish)"; content:"|08|ujtqwaqm|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqm.org.uk (phishing)"; content:"|08|ujtqwaqm|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqo.co.uk (phishing)"; content:"|08|ujtqwaqo|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqo.eu (phishing)"; content:"|08|ujtqwaqo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqo.me.uk (phishing)"; content:"|08|ujtqwaqo|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujtqwaqo.org.uk (phishing)"; content:"|08|ujtqwaqo|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upoyansa.com (ozdok)"; content:"|08|upoyansa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usadospa.com.br (malware)"; content:"|08|usadospa|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useractivesecurity.cn (rogue)"; content:"|12|useractivesecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyre.eu (phish)"; content:"|08|uuuutyre|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyri.eu (phish)"; content:"|08|uuuutyri|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyro.eu (phish)"; content:"|08|uuuutyro|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyrp.eu (phish)"; content:"|08|uuuutyrp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyrr.eu (phish)"; content:"|08|uuuutyrr|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyrt.eu (phish)"; content:"|08|uuuutyrt|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyrv.eu (phish)"; content:"|08|uuuutyrv|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyrw.eu (phish)"; content:"|08|uuuutyrw|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuuutyry.eu (phish)"; content:"|08|uuuutyry|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyerfbvo.cn (zeus)"; content:"|08|uyerfbvo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verissimocafe.kz (ozdok)"; content:"|0d|verissimocafe|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-pcscan2.com (rogue)"; content:"|0d|virus-pcscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viruseliminater2009.com (rogue)"; content:"|13|viruseliminater2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusidentifycenter.com (rogue)"; content:"|13|virusidentifycenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusproktect.com (fakescanner)"; content:"|0d|virusproktect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vpk.freehostia.com (zeus)"; content:"|03|vpk|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vunkonf.com (trojan)"; content:"|07|vunkonf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webanti-spyware.com (rogue)"; content:"|0f|webanti-spyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webantispysoft.com (rogue)"; content:"|0e|webantispysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpcdoctor.com (rogue)"; content:"|0b|webpcdoctor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpcprotect.com (rogue)"; content:"|0c|webpcprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webspydetect.com (rogue)"; content:"|0c|webspydetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wikirocksa.info (ozdok)"; content:"|0a|wikirocksa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-scan0.com (rogue)"; content:"|09|win-scan0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-scan02.com (rogue)"; content:"|0a|win-scan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-scan05.com (rogue)"; content:"|0a|win-scan05|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-scan07.com (rogue)"; content:"|0a|win-scan07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-scan09.com (rogue)"; content:"|0a|win-scan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-scan01.com (rogue)"; content:"|0e|windows-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-scan06.com (rogue)"; content:"|0e|windows-scan06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-scan07.com (rogue)"; content:"|0e|windows-scan07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-scan09.com (rogue)"; content:"|0e|windows-scan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-scan12.com (rogue)"; content:"|0e|windows-scan12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsenterprisesuite.com (rogue)"; content:"|16|windowsenterprisesuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winscanner01.com (rogue)"; content:"|0c|winscanner01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winscanner13.com (rogue)"; content:"|0c|winscanner13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wpolemon.com (trojan)"; content:"|08|wpolemon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdl.nyist.net (phish)"; content:"|03|xdl|05|nyist|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xin9999.com (malware)"; content:"|07|xin9999|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxasqwe.eu (botnet)"; content:"|08|xxxasqwe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxasqwp.eu (botnet)"; content:"|08|xxxasqwp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxasqwz.eu (botnet)"; content:"|08|xxxasqwz|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yankdream.info (ozdok)"; content:"|09|yankdream|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesterdays-party.com (phish)"; content:"|10|yesterdays-party|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yokserezantia.net (ozdok)"; content:"|0d|yokserezantia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yopilazankaza.net (ozdok)"; content:"|0d|yopilazankaza|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you-blocked-me-now-suffer.com (phish)"; content:"|19|you-blocked-me-now-suffer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you-were-nervous.com (phish)"; content:"|10|you-were-nervous|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you-were-not-like-that.com (phish)"; content:"|16|you-were-not-like-that|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourwaybaskets.com (ozdok)"; content:"|0e|yourwaybaskets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytypein.com (trojan)"; content:"|07|ytypein|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszai.eu (phish)"; content:"|08|yyyaszai|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszal.eu (phish)"; content:"|08|yyyaszal|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszao.eu (phish)"; content:"|08|yyyaszao|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszap.eu (phishing)"; content:"|08|yyyaszap|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszaq.eu (phish)"; content:"|08|yyyaszaq|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszar.eu (phishing)"; content:"|08|yyyaszar|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyyaszau.eu (phish)"; content:"|08|yyyaszau|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaaaasaa.eu (botnet)"; content:"|08|zaaaasaa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zavaretalies.com (ozdok)"; content:"|0c|zavaretalies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zmcby6vg.biz (ozdok)"; content:"|08|zmcby6vg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1211news.com (zeus)"; content:"|08|1211news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4realzed.com (malicious)"; content:"|08|4realzed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 520sb.cn (malware)"; content:"|05|520sb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abruzzobooking.it (rfi)"; content:"|0e|abruzzobooking|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addvertseense.co.uk (harmful)"; content:"|0d|addvertseense|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afsharteam1.com (malicious)"; content:"|0b|afsharteam1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinonesecuritya.com (malicious)"; content:"|11|allinonesecuritya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allroundgamers.com (malicious)"; content:"|0e|allroundgamers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amizades.webcindario.com (rfi)"; content:"|08|amizades|0b|webcindario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anathe.com (zeus)"; content:"|06|anathe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiboss.cn (malicious)"; content:"|08|antiboss|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispycenterprof.com (malicious)"; content:"|11|antispycenterprof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware24x7.com (malicious)"; content:"|0f|antispyware24x7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaresnet.com (malicious)"; content:"|0f|antispywaresnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarets.com (malicious)"; content:"|0d|antispywarets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyworldwideint.com (malicious)"; content:"|13|antispyworldwideint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisspywarescenter.com (malicious)"; content:"|13|antisspywarescenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusplus7.com (malicious)"; content:"|0e|antivirusplus7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arcaderesort.com (malicious)"; content:"|0c|arcaderesort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aresmu.com (rfi)"; content:"|06|aresmu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atddlgeo-ucad.dk (exploits)"; content:"|0d|atddlgeo-ucad|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-test-here.org (malicious)"; content:"|0c|av-test-here|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviirusplus.com (malicious)"; content:"|0b|aviirusplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviraplatinum2009.com (malicious)"; content:"|11|aviraplatinum2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backup2009.com (zeus)"; content:"|0a|backup2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup befree2.cn (malicious)"; content:"|07|befree2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belgovision.com (malicious)"; content:"|0b|belgovision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttoolsdirect.com (rogue)"; content:"|0f|besttoolsdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup big5gun.com (malicious)"; content:"|07|big5gun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigdownloadboxessss1.com (zeus)"; content:"|14|bigdownloadboxessss1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bioito.cn (safeweb)"; content:"|06|bioito|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bladespoon.cn (zeus)"; content:"|0a|bladespoon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonuscashh.com (malicious)"; content:"|0a|bonuscashh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonline-protection.co.uk (malicious)"; content:"|16|checkonline-protection|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinaaaredarmy.com (malicious)"; content:"|0e|chinaaaredarmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chungbuk.ac.kr (rfi)"; content:"|08|chungbuk|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-safe-gateway.com (malicious)"; content:"|12|clean-safe-gateway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearstreammultimedia.net (malicious)"; content:"|15|clearstreammultimedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup come.kr (rfi)"; content:"|04|come|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conexionmusical.de (zeus)"; content:"|0f|conexionmusical|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copyrite2009.com (zeus)"; content:"|0c|copyrite2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crusadesecurityservices.com (malicious)"; content:"|17|crusadesecurityservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuhate.cn (malicious)"; content:"|06|cuhate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberneticmoney.com (malicious)"; content:"|0f|cyberneticmoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup day-evryday.cn (malicious)"; content:"|0b|day-evryday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedstar.com (trojan)"; content:"|07|dedstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deeprightnews.net (malicious)"; content:"|0d|deeprightnews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devil511.co.cc (zeus)"; content:"|08|devil511|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diklinodr.cn (malicious)"; content:"|09|diklinodr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djkksdjfkkldjslkdfj.com (zeus)"; content:"|13|djkksdjfkkldjslkdfj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr10.com (malicious)"; content:"|0d|downloadavr10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadsrc.cn (malicious)"; content:"|0b|downloadsrc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadsrc.com (malicious)"; content:"|0b|downloadsrc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dred3.cn (zeus)"; content:"|05|dred3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dunkerquepromotion.org (rfi)"; content:"|12|dunkerquepromotion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eliminater2009pro.com (malicious)"; content:"|11|eliminater2009pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emarkating4you.net (malicious)"; content:"|0e|emarkating4you|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esysprotector2009.com (malicious)"; content:"|11|esysprotector2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exocuit.cn (malicious)"; content:"|07|exocuit|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup explexpl.com (zeus)"; content:"|08|explexpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairplaygames.net (trojan)"; content:"|0d|fairplaygames|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastnety.com (rogue)"; content:"|08|fastnety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesarchivesite.net (malicious)"; content:"|10|filesarchivesite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-web-download.com (malicious)"; content:"|11|free-web-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freefilesarchive.com (malicious)"; content:"|10|freefilesarchive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frenchpropertyshop.com (backdoor)"; content:"|12|frenchpropertyshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friendship888.cn (malicious)"; content:"|0d|friendship888|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frveou438tjfmri.com (zeus)"; content:"|0f|frveou438tjfmri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gener-av.com (malicious)"; content:"|08|gener-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerenstar.com (trojan)"; content:"|09|gerenstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghy65hjghjg.com (zeus)"; content:"|0b|ghy65hjghjg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalfreemultimedia.com (malicious)"; content:"|14|globalfreemultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold-smerch.cn (malicious)"; content:"|0b|gold-smerch|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-space.com (malicious)"; content:"|0c|google-space|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatfilearea.com (malicious)"; content:"|0d|greatfilearea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzzsyy.com.cn (rfi)"; content:"|06|gzzsyy|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadwares.com (malicious)"; content:"|08|hadwares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup head-moron.cn (malicious)"; content:"|0a|head-moron|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hit168.net (rfi)"; content:"|06|hit168|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot99.biz (malicious)"; content:"|05|hot99|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqdedikit.com (malicious)"; content:"|09|hqdedikit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyonsvc.co.kr (rfi)"; content:"|07|hyonsvc|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icewatergame.org (zeus)"; content:"|0c|icewatergame|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idesetcalendes.eu (rfi)"; content:"|0e|idesetcalendes|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup importacionesenergia.com (rfi)"; content:"|14|importacionesenergia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inetgateway1.com (malicious)"; content:"|0c|inetgateway1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infosayt.com (malicious)"; content:"|08|infosayt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inversiontrace.ru (zeus)"; content:"|0e|inversiontrace|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ishigo.cn (malicious)"; content:"|06|ishigo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itsafetyonline.com (malicious)"; content:"|0e|itsafetyonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivirusidentify.com (malicious)"; content:"|0e|ivirusidentify|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingkapadia.com (malicious)"; content:"|0b|kingkapadia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kis-u.com (malicious)"; content:"|05|kis-u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klimat-rostov.ru (rfi)"; content:"|0d|klimat-rostov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kostyushcko.ru (zeus)"; content:"|0b|kostyushcko|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kulibaka.com (malicious)"; content:"|08|kulibaka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifenightfire.com (malicious)"; content:"|0d|lifenightfire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linksafeness.com (malicious)"; content:"|0c|linksafeness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup little-bitty.cn (malicious)"; content:"|0c|little-bitty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesoftbilling.com (malicious)"; content:"|0f|livesoftbilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scan.net (malicious)"; content:"|0c|malware-scan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scaner.biz (malicious)"; content:"|0e|malware-scaner|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scaner.net (malicious)"; content:"|0e|malware-scaner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scaner.org (malicious)"; content:"|0e|malware-scaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketingsmoney.cn (zeus)"; content:"|0f|marketingsmoney|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mebel-hotel.ru (rfi)"; content:"|0b|mebel-hotel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media1980.cn (zeus)"; content:"|09|media1980|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasaite.com (malicious)"; content:"|09|megasaite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meta-new-file.com (malicious)"; content:"|0d|meta-new-file|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mihavom.cn (malicious)"; content:"|07|mihavom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirroronerofive.com (malicious)"; content:"|0f|mirroronerofive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitropox.com (zeus)"; content:"|08|mitropox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mosalep.com (zeus)"; content:"|07|mosalep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moscow4city.info (malicious)"; content:"|0b|moscow4city|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprivatesoft2009.com (malicious)"; content:"|11|myprivatesoft2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkshark.info (zeus)"; content:"|0c|networkshark|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news.allwinsoft.ru (malicious)"; content:"|04|news|0a|allwinsoft|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup night-whale.cn (malicious)"; content:"|0b|night-whale|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notecase.co.kr (malicious)"; content:"|08|notecase|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novadeva.com (malicious)"; content:"|08|novadeva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntwportal.com (malicious)"; content:"|09|ntwportal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onceworld.ru (malicious)"; content:"|09|onceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-counter.cn (malicious)"; content:"|0e|online-counter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantispysoft.com (malicious)"; content:"|11|onlineantispysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlybestnews.cn (malicious)"; content:"|0c|onlybestnews|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ordinaryvoice.cn (malicious)"; content:"|0d|ordinaryvoice|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parchezvous.com (malicious)"; content:"|0b|parchezvous|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parliament.tk (zeus)"; content:"|0a|parliament|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentg.com (malicious)"; content:"|08|paymentg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentgen.com (malicious)"; content:"|0a|paymentgen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcdoctorz2010.com (malicious)"; content:"|0d|pcdoctorz2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprotect2010.com (malicious)"; content:"|0d|pcprotect2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsafety2009pro.com (malicious)"; content:"|0f|pcsafety2009pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsafetyplatinum.com (malicious)"; content:"|10|pcsafetyplatinum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalprotector.net (malicious)"; content:"|11|personalprotector|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phoenixalpine.com (rfi)"; content:"|0d|phoenixalpine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsonlinerxhealth.net (malicious)"; content:"|13|pillsonlinerxhealth|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinvhost.com (malicious)"; content:"|08|pinvhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipisechka.com (malicious)"; content:"|0a|pipisechka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plugininput.com (malicious)"; content:"|0b|plugininput|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poresskey.com (trojan)"; content:"|09|poresskey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powmagazine.se (zeus)"; content:"|0b|powmagazine|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup presenthiring.com (zeus)"; content:"|0d|presenthiring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pressket.com (trojan)"; content:"|08|pressket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prexskey.com (trojan)"; content:"|08|prexskey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prezzkey.com (trojan)"; content:"|08|prezzkey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup propertysearchlistings.com (rfi)"; content:"|16|propertysearchlistings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pussytoip.ws (malicious)"; content:"|09|pussytoip|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickolink.com (rogue)"; content:"|0a|quickolink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realboss.cn (malicious)"; content:"|08|realboss|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirectcounter1.com (malware)"; content:"|10|redirectcounter1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redstyar.com (trojan)"; content:"|08|redstyar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relstagu.ru (malicious)"; content:"|08|relstagu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rfastnet.com (rogue)"; content:"|08|rfastnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rv.slidexxx.cn (malicious)"; content:"|02|rv|08|slidexxx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safemotherhood.org.np (malicious)"; content:"|0e|safemotherhood|03|org|02|np"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salvagemyfiles.com (malicious)"; content:"|0e|salvagemyfiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saved-space.cn (malicious)"; content:"|0b|saved-space|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan.clearyourpconlinescan.com (malicious)"; content:"|04|scan|15|clearyourpconlinescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan.nowscanyoursecurity.com (malicious)"; content:"|04|scan|13|nowscanyoursecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scary-scary.cn (malicious)"; content:"|0b|scary-scary|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-everywhere.com (malicious)"; content:"|11|search-everywhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securekeeper.com (malicious)"; content:"|0c|securekeeper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityprosoft.com (malicious)"; content:"|0f|securityprosoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityztop.com (malicious)"; content:"|0c|securityztop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seedflash.com (malicious)"; content:"|09|seedflash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sensetautonomie.fr (rfi)"; content:"|0f|sensetautonomie|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shavedpoints.cn (malicious)"; content:"|0c|shavedpoints|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitevillain.com (malicious)"; content:"|0b|sitevillain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sixife.com (malicious)"; content:"|06|sixife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socksikovnet.cn (zeus)"; content:"|0c|socksikovnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soemail.sqweebs.com (trojan)"; content:"|07|soemail|07|sqweebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-scanguardmyzone.com (malicious)"; content:"|14|soft-scanguardmyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-scanguardmyzone.net (malicious)"; content:"|14|soft-scanguardmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscan-guardmyzone.com (malicious)"; content:"|14|softscan-guardmyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscan-guardmyzone.net (malicious)"; content:"|14|softscan-guardmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscanguard-myzone.com (malicious)"; content:"|14|softscanguard-myzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscanguard-myzone.net (malicious)"; content:"|14|softscanguard-myzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscanguardmy-zone.com (malicious)"; content:"|14|softscanguardmy-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscanguardmy-zone.net (malicious)"; content:"|14|softscanguardmy-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscanguardmyzone.net (malicious)"; content:"|13|softscanguardmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somecelan.com (rogue)"; content:"|09|somecelan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup someclen.com (rogue)"; content:"|08|someclen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sp-club.h2m.ru (malicious)"; content:"|07|sp-club|03|h2m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spydetector2009.com (malicious)"; content:"|0f|spydetector2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaredetect24pro.com (malicious)"; content:"|12|spywaredetect24pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storepcx.com (zeus)"; content:"|08|storepcx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup style-boards.com (exploits)"; content:"|0c|style-boards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suoerdeuerf44.com (malicious)"; content:"|0d|suoerdeuerf44|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup support.microsoftsavvy.com (malicious)"; content:"|07|support|0e|microsoftsavvy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamspiritrealty.com (rfi)"; content:"|10|teamspiritrealty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theneworderoftheworld.com (zeus)"; content:"|15|theneworderoftheworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tioplus.com (rfi)"; content:"|07|tioplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toysexviet.com (rfi)"; content:"|0a|toysexviet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trust-scanformyzone.net (malicious)"; content:"|13|trust-scanformyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trust-scanonmyzone.net (malicious)"; content:"|12|trust-scanonmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscan-formyzone.net (malicious)"; content:"|13|trustscan-formyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscan-onmyzone.net (malicious)"; content:"|12|trustscan-onmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanfor-myzone.net (malicious)"; content:"|13|trustscanfor-myzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanformy-zone.net (malicious)"; content:"|13|trustscanformy-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanformyzone.net (malicious)"; content:"|12|trustscanformyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanon-myzone.net (malicious)"; content:"|12|trustscanon-myzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanonmy-zone.net (malicious)"; content:"|12|trustscanonmy-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscanonmyzone.net (malicious)"; content:"|11|trustscanonmyzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trypekey.com (trojan)"; content:"|08|trypekey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typeley.com (trojan)"; content:"|07|typeley|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typkey.com (trojan)"; content:"|06|typkey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatedrivers.cn (harmful)"; content:"|0d|updatedrivers|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcashpay.com (rogue)"; content:"|08|vcashpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videochatbuilder.com (rfi)"; content:"|10|videochatbuilder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vihorlat.lietame.sk (rfi)"; content:"|08|vihorlat|07|lietame|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkontalte.cn (malicious)"; content:"|09|vkontalte|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w-opay.com (malicious)"; content:"|06|w-opay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w-optim.com (malicious)"; content:"|07|w-optim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w-optimize.com (malicious)"; content:"|0a|w-optimize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-download-free.com (malicious)"; content:"|11|web-download-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-free-download.com (malicious)"; content:"|11|web-free-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-mix.org (zeus)"; content:"|07|web-mix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webspydetectunlim.com (malicious)"; content:"|11|webspydetectunlim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webtaxfree.com (zeus)"; content:"|0a|webtaxfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wincoresubmit.com (malicious)"; content:"|0d|wincoresubmit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsantispy3.com (malicious)"; content:"|0f|windowsantispy3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsecurepro2009.com (malicious)"; content:"|10|winsecurepro2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winvantivirus.com (malicious)"; content:"|0d|winvantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldantispyware1.com (malicious)"; content:"|11|worldantispyware1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldbestscan2.com (malicious)"; content:"|0e|worldbestscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsantispysoft.com (malicious)"; content:"|11|worldsantispysoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x3wap.ru (malicious)"; content:"|05|x3wap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xenonflashtubes.net (malicious)"; content:"|0f|xenonflashtubes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxodnoklassniki.com (malicious)"; content:"|10|xxxodnoklassniki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yco-nature.com (rfi)"; content:"|0a|yco-nature|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yimiweb.com (zeus)"; content:"|07|yimiweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youramps.ru (malicious)"; content:"|08|youramps|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantivira3.com (rogue)"; content:"|0d|yourantivira3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourantivira7.com (malicious)"; content:"|0d|yourantivira7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 008.dyo9.cn (malware)"; content:"|03|008|04|dyo9|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 371777.com (malware)"; content:"|06|371777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activehealthpack.com (fastflux)"; content:"|10|activehealthpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsyndication.ru (fastflux)"; content:"|0d|adsyndication|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwordanalitycs.ru (fastflux)"; content:"|0f|adwordanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altmedstore.net (fastflux)"; content:"|0b|altmedstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amg777.com (malware)"; content:"|06|amg777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ammednet.com (fastflux)"; content:"|08|ammednet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antifludirect1.net (fastflux)"; content:"|0e|antifludirect1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asianmednet.com (fastflux)"; content:"|0b|asianmednet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autobestpack.com (fastflux)"; content:"|0c|autobestpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bargainfirestore.net (fastflux)"; content:"|10|bargainfirestore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bargainheatstore.net (fastflux)"; content:"|10|bargainheatstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benz990.cn (malware)"; content:"|07|benz990|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestaguide.ru (fastflux)"; content:"|0a|bestaguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdrugclub.net (fastflux)"; content:"|0c|bestdrugclub|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfirelog.net (fastflux)"; content:"|0b|bestfirelog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfirered.net (fastflux)"; content:"|0b|bestfirered|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmedfirealarm.net (fastflux)"; content:"|10|bestmedfirealarm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfdmart.net (fastflux)"; content:"|07|bfdmart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bianmi.net (malware)"; content:"|06|bianmi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biomedinternet.com (fastflux)"; content:"|0e|biomedinternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjlanjingling.com (malware)"; content:"|0d|bjlanjingling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burnstoresunrise.net (fastflux)"; content:"|10|burnstoresunrise|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chike.ptlang.cn (malware)"; content:"|05|chike|06|ptlang|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cj.mychina1.cn (malware)"; content:"|02|cj|08|mychina1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickmeter.ru (fastflux)"; content:"|0a|clickmeter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d2lifeonline.com (malware)"; content:"|0c|d2lifeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detroitfirestore.net (fastflux)"; content:"|10|detroitfirestore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directwap.ru (fastflux)"; content:"|09|directwap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctorfreedrugs.com (fastflux)"; content:"|0f|doctorfreedrugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doublebanner.ru (fastflux)"; content:"|0c|doublebanner|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleclickr.ru (fastflux)"; content:"|0c|doubleclickr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dragonfiremed.net (fastflux)"; content:"|0d|dragonfiremed|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emeddrugs.com (fastflux)"; content:"|09|emeddrugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emedicaldrugs.com (fastflux)"; content:"|0d|emedicaldrugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fludirect.net (fastflux)"; content:"|09|fludirect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galoh.ru (fastflux)"; content:"|05|galoh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodbye.count.xj.cn (malware)"; content:"|07|goodbye|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandresorthot.com (fastflux)"; content:"|0e|grandresorthot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatmedstore.net (fastflux)"; content:"|0d|greatmedstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatstarhotel.com (fastflux)"; content:"|0e|greatstarhotel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatviptravel.net (fastflux)"; content:"|0e|greatviptravel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackernotcracker.fileave.com (rfi)"; content:"|10|hackernotcracker|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hs-limmattal.ch (abusive)"; content:"|0c|hs-limmattal|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htiwg.cn (malware)"; content:"|05|htiwg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idrugsnet.com (fastflux)"; content:"|09|idrugsnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idrugsnetwork.com (fastflux)"; content:"|0d|idrugsnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgframe.com (fastflux)"; content:"|08|imgframe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indexjs.ru (fastflux)"; content:"|07|indexjs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infodrugsnet.com (fastflux)"; content:"|0c|infodrugsnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetbfd.net (fastflux)"; content:"|0b|internetbfd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jokoyuma.fileave.com (rfi)"; content:"|08|jokoyuma|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsportal.ru (fastflux)"; content:"|08|jsportal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kk.henhao321.cn (malware)"; content:"|02|kk|09|henhao321|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letterssite.ru (fastflux)"; content:"|0b|letterssite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup life121.cn (malware)"; content:"|07|life121|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liuyang.h19.y733.cn (malware)"; content:"|07|liuyang|03|h19|04|y733|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medgeneralstore.net (fastflux)"; content:"|0f|medgeneralstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medhomeoffice.com (fastflux)"; content:"|0d|medhomeoffice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medlinepills.com (fastflux)"; content:"|0c|medlinepills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medpillsbargain.net (fastflux)"; content:"|0f|medpillsbargain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medprocottage.com (fastflux)"; content:"|0d|medprocottage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medstorebargain.net (fastflux)"; content:"|0f|medstorebargain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medwaynet.net (fastflux)"; content:"|09|medwaynet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meimeitiantang.info (malware)"; content:"|0e|meimeitiantang|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftantiflu.net (fastflux)"; content:"|10|microsoftantiflu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mychina1.cn (malware)"; content:"|08|mychina1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neoconflux.net (fastflux)"; content:"|0a|neoconflux|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlifeworld.ru (fastflux)"; content:"|0c|newlifeworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonfluguide.net (fastflux)"; content:"|0b|nonfluguide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nortonantiflu.net (fastflux)"; content:"|0d|nortonantiflu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinecasinosstore.net (fastflux)"; content:"|12|onlinecasinosstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedatingmart.net (fastflux)"; content:"|10|onlinedatingmart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedrugsweb.net (fastflux)"; content:"|0e|onlinedrugsweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemeddirect.net (fastflux)"; content:"|0f|onlinemeddirect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemeddiscount.net (fastflux)"; content:"|11|onlinemeddiscount|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemedfixtures.net (fastflux)"; content:"|11|onlinemedfixtures|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemedsite.net (fastflux)"; content:"|0d|onlinemedsite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemedworld.net (fastflux)"; content:"|0e|onlinemedworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineshopmart.net (fastflux)"; content:"|0e|onlineshopmart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineshopmedguide.net (fastflux)"; content:"|12|onlineshopmedguide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineshoppingmarket.net (fastflux)"; content:"|14|onlineshoppingmarket|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open2009.net (malware)"; content:"|08|open2009|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outyourflux.net (fastflux)"; content:"|0b|outyourflux|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pailleantireflux.net (fastflux)"; content:"|10|pailleantireflux|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peoplemedstore.net (fastflux)"; content:"|0e|peoplemedstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacyvipsite.net (fastflux)"; content:"|0f|pharmacyvipsite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmasyspaceonline.com (fastflux)"; content:"|13|pharmasyspaceonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmasystarworld.com (fastflux)"; content:"|11|pharmasystarworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipelogicservices.com (abusive)"; content:"|11|pipelogicservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plusbest.ru (fastflux)"; content:"|08|plusbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pop3.123fga.cn (malware)"; content:"|04|pop3|06|123fga|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pp123a.cn (malware)"; content:"|06|pp123a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purewellnessherb.com (fastflux)"; content:"|10|purewellnessherb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjwlb.cn (malware)"; content:"|05|qjwlb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqzn109.cn (malware)"; content:"|07|qqzn109|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualitysuper.ru (fastflux)"; content:"|0c|qualitysuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvod-50.com (malware)"; content:"|07|qvod-50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s0so.net (malware)"; content:"|04|s0so|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savageconsulyb.net (fastflux)"; content:"|0e|savageconsulyb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scriptjs.ru (fastflux)"; content:"|08|scriptjs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securemedstore.net (fastflux)"; content:"|0e|securemedstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekpornworld.com (fastflux)"; content:"|0d|seekpornworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shion5.80.cnnicidc.com (malware)"; content:"|06|shion5|02|80|08|cnnicidc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shscyy.cn (malware)"; content:"|06|shscyy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sina.langlangdoor.com (malware)"; content:"|04|sina|0c|langlangdoor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siteanalitycs.ru (fastflux)"; content:"|0d|siteanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starssuperpack.com (fastflux)"; content:"|0e|starssuperpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starsuperpack.com (fastflux)"; content:"|0d|starsuperpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfullpack.com (fastflux)"; content:"|0d|superfullpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermatingsite.com (fastflux)"; content:"|0f|supermatingsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superpharmasystar.com (fastflux)"; content:"|11|superpharmasystar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfsahnrnvn.com (fastflux)"; content:"|0a|tfsahnrnvn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebloodpack.com (fastflux)"; content:"|0c|thebloodpack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thedrugstor.com (fastflux)"; content:"|0b|thedrugstor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theeasyriver.ru (fastflux)"; content:"|0c|theeasyriver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefinehealth.com (fastflux)"; content:"|0d|thefinehealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tom10.cn (malware)"; content:"|05|tom10|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toroplistyn.com (fastflux)"; content:"|0b|toroplistyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tw789.com (malware)"; content:"|05|tw789|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tw9qye1vpw.com (fastflux)"; content:"|0a|tw9qye1vpw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ueopen.com (phishing)"; content:"|06|ueopen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usea51la.cn (malware)"; content:"|08|usea51la|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usgraphicsource.com (fastflux)"; content:"|0f|usgraphicsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uui8uy.cn (malware)"; content:"|06|uui8uy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmedpills5.com (fastflux)"; content:"|0c|webmedpills5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwmedpills.com (fastflux)"; content:"|0b|wwwmedpills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcdx169.net (malware)"; content:"|07|xcdx169|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xingfu5yt.info (malware)"; content:"|09|xingfu5yt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xinhh20.com (malware)"; content:"|07|xinhh20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoosite.ru (fastflux)"; content:"|09|yahoosite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourdrugsweb.com (fastflux)"; content:"|0c|yourdrugsweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytfushan.com (malware)"; content:"|08|ytfushan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znwork.com (malware)"; content:"|06|znwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zokre.cn (trojan)"; content:"|05|zokre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123-shippings.com (fraud)"; content:"|0d|123-shippings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123fga.cn (malware)"; content:"|06|123fga|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 18474.rrvv.net (malware)"; content:"|05|18474|04|rrvv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 323o.cn (trojan)"; content:"|04|323o|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51se8.com (malware)"; content:"|05|51se8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 578la.com (malware)"; content:"|05|578la|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abt-logq.com (fraud_scam)"; content:"|08|abt-logq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allianceleicester-bk.com (fraud_scam)"; content:"|14|allianceleicester-bk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-freeeze.cn (malicious)"; content:"|0a|an-freeeze|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analistikyandeks.cn (malicious)"; content:"|10|analistikyandeks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analystics.cn (malicious)"; content:"|0a|analystics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angle-meter.com (malware)"; content:"|0b|angle-meter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anglointerpacific.com (fraud)"; content:"|11|anglointerpacific|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup argentinastyle.cn (koobface)"; content:"|0e|argentinastyle|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup argentmarketingtools.com (fraudtool)"; content:"|14|argentmarketingtools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aslowride.com (rogue)"; content:"|09|aslowride|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aub-online.com (fraud_scam)"; content:"|0a|aub-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanhere.in (malicious)"; content:"|0b|av-scanhere|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-test-here.in (malicious)"; content:"|0c|av-test-here|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avtest-now.in (malicious)"; content:"|0a|avtest-now|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balloonbow.com (malicious)"; content:"|0a|balloonbow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup base1925.net (zeus)"; content:"|08|base1925|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basic.free-host.in (exploit)"; content:"|05|basic|09|free-host|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured.cn (malicious)"; content:"|0a|be-secured|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bea-transport.com (fraud)"; content:"|0d|bea-transport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestalltools.com (fraudtool)"; content:"|0c|bestalltools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcv.ro (malicious)"; content:"|06|bestcv|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscan044.cn (koobface)"; content:"|0b|bestscan044|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestscan066.cn (koobface)"; content:"|0b|bestscan066|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecureweb.cn (malicious)"; content:"|0d|bestsecureweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkoaf.com (fraud_scam)"; content:"|05|bkoaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blueartscube.com (trojan)"; content:"|0c|blueartscube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bochkbank.com (fraud_scam)"; content:"|09|bochkbank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bussacker.de (zeus)"; content:"|09|bussacker|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caninespecialtyservices.net (rfi)"; content:"|17|caninespecialtyservices|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cars-shipping.org (fraud)"; content:"|0d|cars-shipping|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centermediaarea.net (malicious)"; content:"|0f|centermediaarea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cepsaltda.cl (malware)"; content:"|09|cepsaltda|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cftb-uk.com (fraud_scam)"; content:"|07|cftb-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childbirth2000.cn (rogue)"; content:"|0e|childbirth2000|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup china.schreiber-hp.de (exploits)"; content:"|05|china|0c|schreiber-hp|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citifunding.us (fraud_scam)"; content:"|0b|citifunding|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooperativeunionesp.com (fraud_scam)"; content:"|13|cooperativeunionesp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coremediaarea.com (malicious)"; content:"|0d|coremediaarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countsafe-c.com (fraud_scam)"; content:"|0b|countsafe-c|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup couples-retreat.cn (malicious)"; content:"|0f|couples-retreat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csshippers.com (fraud)"; content:"|0a|csshippers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-scan-2.com (malicious)"; content:"|0c|cyber-scan-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup da2ud5ed.cn (trojan)"; content:"|08|da2ud5ed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deliverspeedltd.com (fraud)"; content:"|0f|deliverspeedltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dellilawservices.com (fraud_scam)"; content:"|10|dellilawservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhszgh.org (rfi)"; content:"|06|dhszgh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirddrf.be (zbot)"; content:"|07|dirddrf|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkles2jc.cn (zeus)"; content:"|08|dkles2jc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlsports.be (zbot)"; content:"|08|dlsports|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domoktov.com (malicious)"; content:"|08|domoktov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dor-cargo.com (fraud)"; content:"|09|dor-cargo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dscexpress.com (fraud)"; content:"|0a|dscexpress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdloadstorage.com (malicious)"; content:"|0e|dvdloadstorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdplayersstorage.net (malicious)"; content:"|11|dvdplayersstorage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebay-purchaseprotection.com (fraud_scam)"; content:"|17|ebay-purchaseprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup economyguide.cn (malicious)"; content:"|0c|economyguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edwoodmovie.cn (malicious)"; content:"|0b|edwoodmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekolgistictrans.com (fraud)"; content:"|0f|ekolgistictrans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup el1x.cn (scareware)"; content:"|04|el1x|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup el2x.cn (scareware)"; content:"|04|el2x|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup el3x.cn (scareware)"; content:"|04|el3x|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electro-place.net (fraud_scam)"; content:"|0d|electro-place|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elektro-boss.com (fraud_scam)"; content:"|0c|elektro-boss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enginesoons.cn (malicious)"; content:"|0b|enginesoons|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterprisedefender.net (malicious)"; content:"|12|enterprisedefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup espantservices.eu (fraud_scam)"; content:"|0e|espantservices|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etherealtravel.com (fraud_scam)"; content:"|0e|etherealtravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euromaxsecurities.com (fraud_scam)"; content:"|11|euromaxsecurities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eutrans-ltd.com (fraud)"; content:"|0b|eutrans-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expatraite-visa-office.com (fraud_scam)"; content:"|16|expatraite-visa-office|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup express-transporters.com (fraud)"; content:"|14|express-transporters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebooktbtoolbar.ourtoolbar.com (virus)"; content:"|11|facebooktbtoolbar|0a|ourtoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdscompany4u.com (fraud_scam)"; content:"|0c|fdscompany4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenixloja.com.br (exploits)"; content:"|09|fenixloja|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findcopyright.org (malicious)"; content:"|0d|findcopyright|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findcredible.org (malicious)"; content:"|0c|findcredible|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findeditors.org (malicious)"; content:"|0b|findeditors|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findelsewhere.org (malicious)"; content:"|0d|findelsewhere|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findreasonable.org (malicious)"; content:"|0e|findreasonable|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finislamicbank.com (fraud_scam)"; content:"|0e|finislamicbank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firemultimediazone.com (malicious)"; content:"|12|firemultimediazone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fixerrorsoon.com (malicious)"; content:"|0c|fixerrorsoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashsettingsonline.com (malicious)"; content:"|13|flashsettingsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpddrs.be (zbot)"; content:"|07|ftpddrs|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g8856.cn (exploits)"; content:"|05|g8856|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamno6.cn (zeus)"; content:"|06|gamno6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup garmin-win.biz (malicious)"; content:"|0a|garmin-win|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerg4tt4tfgdd.com (malware)"; content:"|0d|gerg4tt4tfgdd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globallineinc.com (fraud)"; content:"|0d|globallineinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold2-ht61b.ws (zbot)"; content:"|0b|gold2-ht61b|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-protection.cn (malicious)"; content:"|0f|good-protection|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodsoftwarestorage.com (malicious)"; content:"|13|goodsoftwarestorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatactualtube.net (malicious)"; content:"|0f|greatactualtube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatmoder.cn (malicious)"; content:"|0a|greatmoder|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatnames-12.cn (malicious)"; content:"|0d|greatnames-12|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatstories00.cn (malicious)"; content:"|0e|greatstories00|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattoolsonline.com (fraudtool)"; content:"|10|greattoolsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwebarts.com (trojan)"; content:"|0c|greatwebarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groundhogday2.cn (malicious)"; content:"|0d|groundhogday2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groupe-rouquette.com (rfi)"; content:"|10|groupe-rouquette|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gulfunionbnk.com (fraud_scam)"; content:"|0c|gulfunionbnk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzhhy.com (malware)"; content:"|05|gzhhy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hcmdmc.com (rfi)"; content:"|06|hcmdmc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hirovecul.cn (malicious)"; content:"|09|hirovecul|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpmail.com (typosquatted)"; content:"|08|hotpmail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i3219.cn (exploits)"; content:"|05|i3219|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iekmn.cn (malware)"; content:"|05|iekmn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inspectsun.com (malicious)"; content:"|0a|inspectsun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interauto-shippers.com (fraud)"; content:"|12|interauto-shippers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup international-freight-transport.com (fraud)"; content:"|1f|international-freight-transport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup join2bestsecuritynow.com (malicious)"; content:"|14|join2bestsecuritynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jonebrosengineering.com (fraud_scam)"; content:"|13|jonebrosengineering|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keepcop.com (malicious)"; content:"|07|keepcop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamaze2009.cn (rogue)"; content:"|0a|lamaze2009|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lego-billiger.com (fraud_scam)"; content:"|0d|lego-billiger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lego-discount.com (fraud_scam)"; content:"|0d|lego-discount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lego-fabrik.com (fraud_scam)"; content:"|0b|lego-fabrik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leo-arts-galls.com (trojan)"; content:"|0e|leo-arts-galls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup levasycu.cn (malicious)"; content:"|08|levasycu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lingobest.info (zeus)"; content:"|09|lingobest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lisoft.eu (rogue)"; content:"|06|lisoft|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup london-homerentals.co.uk (fraud_scam)"; content:"|12|london-homerentals|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup londonfootball-coaching.org.uk (fraud_scam)"; content:"|17|londonfootball-coaching|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebtyes.com (malicious)"; content:"|0c|malwarebtyes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebypes.com (malicious)"; content:"|0c|malwarebypes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcmoto-tmax.com (malicious)"; content:"|0d|marcmoto-tmax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marvidzstravels.com (fraud_scam)"; content:"|0f|marvidzstravels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxel-vuds.com (malicious)"; content:"|0a|maxel-vuds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maybankaccounts.com (fraud_scam)"; content:"|0f|maybankaccounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdsimmons.com (malicious)"; content:"|09|mdsimmons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasiter.com (rogue)"; content:"|09|megasiter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miarci.com (malicious)"; content:"|06|miarci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mm.icvpn.cn (malware)"; content:"|02|mm|05|icvpn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modertps.be (zbot)"; content:"|08|modertps|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneyinfom.com (malware)"; content:"|0a|moneyinfom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moralisefilm.cn (malicious)"; content:"|0c|moralisefilm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mororun.com (trojan)"; content:"|07|mororun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motionvm.com (malware)"; content:"|08|motionvm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msbitsoftware.com (virus)"; content:"|0d|msbitsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn.cn.b51c.cn (malware)"; content:"|03|msn|02|cn|04|b51c|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multicentrum.net (malicious)"; content:"|0c|multicentrum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup munsterjeger.net (malicious)"; content:"|0c|munsterjeger|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murrr.net (malicious)"; content:"|05|murrr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytha-epaycentertrend.com (fraud_scam)"; content:"|15|mytha-epaycentertrend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nct2000.com (trojan)"; content:"|07|nct2000|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newworldsuccess.cn (malicious)"; content:"|0f|newworldsuccess|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicecodestorage.com (malicious)"; content:"|0f|nicecodestorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonsensical.cn (malicious)"; content:"|0b|nonsensical|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordstromexpress.com (fraud)"; content:"|10|nordstromexpress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notebooks-store.com (fraud_scam)"; content:"|0f|notebooks-store|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npcbonline.org (fraud_scam)"; content:"|0a|npcbonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceanicbk-ng-online.com (fraud_scam)"; content:"|13|oceanicbk-ng-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohioautoshippersllc.com (fraud)"; content:"|13|ohioautoshippersllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onyxmovers.com (fraud)"; content:"|0a|onyxmovers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup org-tech.net (malicious)"; content:"|08|org-tech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osadwarekill2009.com (malicious)"; content:"|10|osadwarekill2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacificcreditfinance.net (fraud_scam)"; content:"|14|pacificcreditfinance|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pacificshipping.org (fraud)"; content:"|0f|pacificshipping|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paoevinho.com.br (rfi)"; content:"|09|paoevinho|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parksensorucenter.com (malicious)"; content:"|11|parksensorucenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pay-down-my-mortgage.com (malware)"; content:"|14|pay-down-my-mortgage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinggost.com (trojan)"; content:"|08|pinggost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinumdefence.cn (malicious)"; content:"|0f|platinumdefence|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polaris-transportation-group.com (fraud)"; content:"|1c|polaris-transportation-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portorate8.com (malware)"; content:"|0a|portorate8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup power-security.cn (malicious)"; content:"|0e|power-security|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prostodomen.com (harmful)"; content:"|0b|prostodomen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pussypiska.info (trojan)"; content:"|0a|pussypiska|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualityflashsettings.com (malicious)"; content:"|14|qualityflashsettings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickselectmultimedia.com (malicious)"; content:"|15|quickselectmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicktimeshipping.com (fraud)"; content:"|11|quicktimeshipping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbsunitedkingdom.com (fraud_scam)"; content:"|10|rbsunitedkingdom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regtimer.cn (malicious)"; content:"|08|regtimer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relaxmp3.co.uk (exploits)"; content:"|08|relaxmp3|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repeatability.cn (malicious)"; content:"|0d|repeatability|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rjhao.cn (malware)"; content:"|05|rjhao|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rt-online.cn (zbot)"; content:"|09|rt-online|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-file-clear.com (malicious)"; content:"|0f|scan-file-clear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-mypc-now.in (malicious)"; content:"|0d|scan-mypc-now|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4malware.cn (malicious)"; content:"|0c|scan4malware|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4spyware.cn (malicious)"; content:"|0c|scan4spyware|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup script-meta09.com (malicious)"; content:"|0d|script-meta09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchenginecenter.org (malicious)"; content:"|12|searchenginecenter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityeverywhere.cn (malicious)"; content:"|12|securityeverywhere|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolblog.com (malicious)"; content:"|10|securitytoolblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolcode.com (malicious)"; content:"|10|securitytoolcode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytooledit.com (malicious)"; content:"|10|securitytooledit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolmaker.com (malicious)"; content:"|11|securitytoolmaker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytooltoday.com (malicious)"; content:"|11|securitytooltoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoponline-motors.com (fraud_scam)"; content:"|11|shoponline-motors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoppingxxxsource.com (rfi)"; content:"|11|shoppingxxxsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simpsonet.com (malicious)"; content:"|09|simpsonet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitetransport.ru (exploits)"; content:"|0d|sitetransport|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skynety.com (malicious)"; content:"|07|skynety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sliwride.com (trojan)"; content:"|08|sliwride|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slowide.com (trojan)"; content:"|07|slowide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spectrum-contracting.co.uk (fraud_scam)"; content:"|14|spectrum-contracting|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spellaudit.com (malicious)"; content:"|0a|spellaudit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup springhousearts.net (trojan)"; content:"|0f|springhousearts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-9.cn (exploit)"; content:"|0b|stallvars-9|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stamex-expedition.com (fraud)"; content:"|11|stamex-expedition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sungminship.com (malicious)"; content:"|0b|sungminship|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-choice-now1.cn (malicious)"; content:"|11|super-choice-now1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-choice.cn (malicious)"; content:"|0c|super-choice|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-choicehere2.cn (malicious)"; content:"|11|super-choicehere2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superactualtube.com (malicious)"; content:"|0f|superactualtube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superdecision123034.cn (malicious)"; content:"|13|superdecision123034|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supernil.ru (exploits)"; content:"|08|supernil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swedishacademi.se (malicious)"; content:"|0e|swedishacademi|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelegallywildbunch.com (zeus)"; content:"|13|thelegallywildbunch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetoolsbargain.com (fraudtool)"; content:"|0f|thetoolsbargain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topexternal.com (malicious)"; content:"|0b|topexternal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topmultimediaworld.com (malicious)"; content:"|12|topmultimediaworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradeservise.com (malicious)"; content:"|0c|tradeservise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trax-holdings.co.uk (fraud)"; content:"|0d|trax-holdings|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truesepl.com (rogue)"; content:"|08|truesepl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustescrowbnk.com (fraud_scam)"; content:"|0e|trustescrowbnk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt20091124.com (koobface)"; content:"|0b|ttt20091124|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twelvemonkeysmovie.cn (malicious)"; content:"|12|twelvemonkeysmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u-toys.com (malicious)"; content:"|06|u-toys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unitedbankofmalaysia.com (fraud_scam)"; content:"|14|unitedbankofmalaysia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup universallogisticsltd.com (fraud)"; content:"|15|universallogisticsltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utopiantravels.com (fraud_scam)"; content:"|0e|utopiantravels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vargogolfcompany.com (malware)"; content:"|10|vargogolfcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzg.co.uk (zbot)"; content:"|06|verzzg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzg.me.uk (zbot)"; content:"|06|verzzg|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzg.org.uk (zbot)"; content:"|06|verzzg|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzi.co.uk (zbot)"; content:"|06|verzzi|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzi.org.uk (zbot)"; content:"|06|verzzi|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzm.co.uk (zbot)"; content:"|06|verzzm|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzm.me.uk (zbot)"; content:"|06|verzzm|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzm.org.uk (zbot)"; content:"|06|verzzm|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzn.co.uk (zbot)"; content:"|06|verzzn|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzn.me.uk (zbot)"; content:"|06|verzzn|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzn.org.uk (zbot)"; content:"|06|verzzn|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzq.co.uk (zbot)"; content:"|06|verzzq|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzq.me.uk (zbot)"; content:"|06|verzzq|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verzzq.org.uk (zbot)"; content:"|06|verzzq|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videotoolonline.net (malicious)"; content:"|0f|videotoolonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vir-cure-mypcnow.com (malicious)"; content:"|10|vir-cure-mypcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viridentifycenter.com (malicious)"; content:"|11|viridentifycenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w23q.cn (malware)"; content:"|04|w23q|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wachovia-onlineuk.com (fraud_scam)"; content:"|11|wachovia-onlineuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websecurity2.cn (malicious)"; content:"|0c|websecurity2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsenterprisedefender.net (malicious)"; content:"|19|windowsenterprisedefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwsfx.com (malware)"; content:"|05|xwsfx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-security.cn (malicious)"; content:"|0d|your-security|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourfreescanner.com (malicious)"; content:"|0f|yourfreescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zapotec2.cn (malicious)"; content:"|08|zapotec2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100brandtoys.com (rogue)"; content:"|0c|100brandtoys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2009antispyware.net (rogue)"; content:"|0f|2009antispyware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 20zz.co.cc (zeus)"; content:"|04|20zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51yes.com (malware)"; content:"|05|51yes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7d44f12b6e.net (malware)"; content:"|0a|7d44f12b6e|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abemauf.com (fastflux)"; content:"|07|abemauf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup addressoffers.com (malware)"; content:"|0d|addressoffers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwordsformoneymail.cn (exploit)"; content:"|13|adwordsformoneymail|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afternoonteamenu.biz (exploit)"; content:"|10|afternoonteamenu|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup againstspyware.com (rogue)"; content:"|0e|againstspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajxpeehuvpcv.com (exploit)"; content:"|0c|ajxpeehuvpcv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amebas.cn (zbot)"; content:"|06|amebas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-flu.net (malicious)"; content:"|09|an-ty-flu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virusblog.net (threat)"; content:"|0f|an-ty-virusblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virusnow.net (malicious)"; content:"|0e|an-ty-virusnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virusonline.net (malicious)"; content:"|11|an-ty-virusonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virusshop.net (malicious)"; content:"|0f|an-ty-virusshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virussite.net (malicious)"; content:"|0f|an-ty-virussite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virusstore.net (malicious)"; content:"|10|an-ty-virusstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-virustoday.net (malicious)"; content:"|10|an-ty-virustoday|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-spyware-2010.net (malicious)"; content:"|11|anti-spyware-2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-plus2011.com (malicious)"; content:"|13|anti-virus-plus2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-plus2012.com (malicious)"; content:"|13|anti-virus-plus2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virusshop.net (malicious)"; content:"|0e|anti-virusshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virustoday.net (malicious)"; content:"|0f|anti-virustoday|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antidopings.cn (zeus)"; content:"|0b|antidopings|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiivirusplus.com (malicious)"; content:"|0e|antiivirusplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiplus2010.com (malicious)"; content:"|0c|antiplus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareglobal.com (rogue)"; content:"|11|antispywareglobal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareonline.net (malicious)"; content:"|11|antispywareonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareweb.net (malicious)"; content:"|0e|antispywareweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live.net (malicious)"; content:"|0e|antivirus-live|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-service.net (malicious)"; content:"|11|antivirus-service|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruscenter.net (malicious)"; content:"|0f|antiviruscenter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusexpert.net (malicious)"; content:"|0f|antivirusexpert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruslive-pro.com (rogue)"; content:"|11|antiviruslive-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruslive2010.com (rogue)"; content:"|11|antiviruslive2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruslivepro.com (rogue)"; content:"|10|antiviruslivepro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirustop.net (malicious)"; content:"|0c|antivirustop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyflu.net (malicious)"; content:"|07|antyflu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyflutool.net (malicious)"; content:"|0b|antyflutool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusdevice.net (malicious)"; content:"|0f|antyvirusdevice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusgadget.net (malicious)"; content:"|0f|antyvirusgadget|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusinstrument.net (malicious)"; content:"|13|antyvirusinstrument|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusservicesite.com (malware)"; content:"|14|antyvirusservicesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustoolblog.net (malicious)"; content:"|11|antyvirustoolblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustoolonline.net (malicious)"; content:"|13|antyvirustoolonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustools.net (malicious)"; content:"|0e|antyvirustools|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustoolshop.net (malicious)"; content:"|11|antyvirustoolshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustoolsite.net (malicious)"; content:"|11|antyvirustoolsite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirustooltoday.net (malicious)"; content:"|12|antyvirustooltoday|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aolas.cn (zeus)"; content:"|05|aolas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup argulmi.com (fastflux)"; content:"|07|argulmi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av.ghura.pl (trojan )"; content:"|02|av|05|ghura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baby2girls.ru (trojan )"; content:"|0a|baby2girls|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-ever-movies.com (rogue)"; content:"|10|best-ever-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-world-actors.com (rogue)"; content:"|11|best-world-actors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-world-celebrities.com (rogue)"; content:"|16|best-world-celebrities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestan-ty-virus.net (malicious)"; content:"|0f|bestan-ty-virus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantyvirusservice.com (malware)"; content:"|14|bestantyvirusservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantyvirustool.net (malicious)"; content:"|11|bestantyvirustool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestflvdata.com (trojan)"; content:"|0b|bestflvdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecurityonline.net (malicious)"; content:"|12|bestsecurityonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizbrobiz.cn (exploit)"; content:"|09|bizbrobiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodybulding.ru (trojan )"; content:"|0b|bodybulding|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulkleen.com (attack_site)"; content:"|08|bulkleen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleantraffic1.com (malicious)"; content:"|0d|cleantraffic1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup co3453453.com (zbot)"; content:"|09|co3453453|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cp1000.free-porn-xxx.info (zango)"; content:"|06|cp1000|0d|free-porn-xxx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailynews6x24.com (zbot)"; content:"|0d|dailynews6x24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delltrustedsecuritya.cn (harmfull)"; content:"|14|delltrustedsecuritya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsprotectionservice.com (malicious)"; content:"|14|dnsprotectionservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domreha.cn (rogue)"; content:"|07|domreha|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.68ku.com (trojan )"; content:"|04|down|04|68ku|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-mt.net (exploit)"; content:"|15|federalreservebank-mt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-nh.net (exploit)"; content:"|15|federalreservebank-nh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-nj.net (exploit)"; content:"|15|federalreservebank-nj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashmediaoriginsite.com (malicious)"; content:"|14|flashmediaoriginsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashmediasource.net (malicious)"; content:"|10|flashmediasource|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-download-net.com (malicious)"; content:"|11|free-download-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-download-net.info (trojan )"; content:"|11|free-download-net|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-download-net.net (malicious)"; content:"|11|free-download-net|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-download-net.org (trojan )"; content:"|11|free-download-net|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-spyware-scanner.biz (trojan )"; content:"|14|free-spyware-scanner|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-spyware-scanner.info (trojan )"; content:"|14|free-spyware-scanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-spyware-scanner.net (malicious)"; content:"|14|free-spyware-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-spyware-scanner.org (malicious)"; content:"|14|free-spyware-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freean-ty-virus.net (malicious)"; content:"|0f|freean-ty-virus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemediasoftxx.com (trojan)"; content:"|0f|freemediasoftxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freesecurityonline.net (malicious)"; content:"|12|freesecurityonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frwxz.cn (trojan )"; content:"|05|frwxz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gen-av-pay.com (malicious)"; content:"|0a|gen-av-pay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gen-avpay.com (malicious)"; content:"|09|gen-avpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genav-pay.com (malicious)"; content:"|09|genav-pay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genavpay.com (malicious)"; content:"|08|genavpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genpropay.com (malicious)"; content:"|09|genpropay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getpersprtv2.net (malicious)"; content:"|0c|getpersprtv2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getsmrtprt-v2.com (malicious)"; content:"|0d|getsmrtprt-v2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getvideo2010-now.com (malicious)"; content:"|10|getvideo2010-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glousc.com (malware)"; content:"|06|glousc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlev2010.com (fakegoogle)"; content:"|0b|googlev2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup green-power-zone.com (malicious)"; content:"|10|green-power-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenpeaceleage.com (rogue)"; content:"|0f|greenpeaceleage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenpowerguns.com (rogue)"; content:"|0e|greenpowerguns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grobin1.cn (exploit)"; content:"|07|grobin1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtoscanforviruses.com (malicious)"; content:"|13|howtoscanforviruses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iewarningsite.com (rogue)"; content:"|0d|iewarningsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabivu.cn (rogue)"; content:"|06|kabivu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kijojg.net (exploit)"; content:"|06|kijojg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kimosimotuma.cn (malware)"; content:"|0c|kimosimotuma|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komisunwinter.com (zeus)"; content:"|0d|komisunwinter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laorexue.com (backdoor )"; content:"|08|laorexue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lg899.cn (trojan )"; content:"|05|lg899|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadsoftwarebase.com (trojan)"; content:"|10|loadsoftwarebase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-destroy6.com (rogue)"; content:"|10|malware-destroy6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarealsscan.com (harmful)"; content:"|0e|malwarealsscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareantivirusscan.com (rogue)"; content:"|14|malwareantivirusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareexamination.com (threat)"; content:"|12|malwareexamination|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareexamine.com (rogue)"; content:"|0e|malwareexamine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarescanworld.com (malware)"; content:"|10|malwarescanworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manualmultimedia.com (malicious)"; content:"|10|manualmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadatahouse.com (harmfull)"; content:"|0e|mediadatahouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metraiciono.com (harmfull)"; content:"|0b|metraiciono|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ministerstvo.cn (zeus)"; content:"|0c|ministerstvo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmoworlds.cn (zeus)"; content:"|09|mmoworlds|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneychanel.biz (malware)"; content:"|0b|moneychanel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneypress.ru (malicious)"; content:"|0a|moneypress|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mordes.su (exploit)"; content:"|06|mordes|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mortisonline.com (harmfull)"; content:"|0c|mortisonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mrmennoisy.cn (malware)"; content:"|0a|mrmennoisy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediahelpcenter.com (trojan)"; content:"|14|multimediahelpcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myan-ty-virus.net (malicious)"; content:"|0d|myan-ty-virus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantyvirustool.net (malicious)"; content:"|0f|myantyvirustool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfacelol.com (malicious)"; content:"|09|myfacelol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantivirussoft.com (harmfull)"; content:"|10|newantivirussoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantyvirustool.net (malicious)"; content:"|10|newantyvirustool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmediastandart.com (malicious)"; content:"|10|newmediastandart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-new-tube.com (malicious)"; content:"|0d|porn-new-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-new-tube.info (trojan )"; content:"|0d|porn-new-tube|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-new-tube.net (malicious)"; content:"|0d|porn-new-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-new-tube.org (trojan )"; content:"|0d|porn-new-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntakevideo.com (rogue)"; content:"|0d|porntakevideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection2010.com (rogue)"; content:"|0e|protection2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectorservice.com (rogue)"; content:"|10|protectorservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security2010.net (malicious)"; content:"|0c|security2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityonlineblog.net (malicious)"; content:"|12|securityonlineblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityonlinenow.net (malicious)"; content:"|11|securityonlinenow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityonlinetoday.net (malicious)"; content:"|13|securityonlinetoday|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setsoftwaresupport.com (trojan)"; content:"|12|setsoftwaresupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartdnshost.com (malicious)"; content:"|0c|smartdnshost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartprotectorv2.com (malicious)"; content:"|10|smartprotectorv2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solidws.com (malicious)"; content:"|07|solidws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup souzmov.cn (attack_site)"; content:"|07|souzmov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spysystemcom.cn (zbot)"; content:"|0c|spysystemcom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stahlhandel-mechernich.de (trojan )"; content:"|16|stahlhandel-mechernich|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup standartmultimedia.com (malicious)"; content:"|12|standartmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startechmultimedia.com (malicious)"; content:"|12|startechmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-read-message.com (malicious)"; content:"|11|stop-read-message|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunkub.com (trojan )"; content:"|06|sunkub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superantivirus.net (malicious)"; content:"|0e|superantivirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysdefence.com (rogue)"; content:"|0a|sysdefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-deffender.com (rogue)"; content:"|10|system-deffender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemprotector.net (malicious)"; content:"|0f|systemprotector|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talmeris.com (trojanzbot )"; content:"|08|talmeris|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdpc-computer.com (malicious)"; content:"|0d|tdpc-computer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdpc-computer.net (malicious)"; content:"|0d|tdpc-computer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdpc-computer22.net (malicious)"; content:"|0f|tdpc-computer22|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teacoffeeguide.com (rogue)"; content:"|0e|teacoffeeguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teensfuckteenvideos.info (zango)"; content:"|13|teensfuckteenvideos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teh10ll1.be (fastflux)"; content:"|08|teh10ll1|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thean-ty-virus.net (malicious)"; content:"|0e|thean-ty-virus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themultimediahot.net (harmfull)"; content:"|10|themultimediahot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thescandan.com (rogue)"; content:"|0a|thescandan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinytubetv.com (harmfull)"; content:"|0a|tinytubetv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todolust.com (malicious)"; content:"|08|todolust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-filter-2011.com (malicious)"; content:"|13|traffic-filter-2011|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-filter-2012.com (malicious)"; content:"|13|traffic-filter-2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustedmicrosoftscan2.com (malicious)"; content:"|15|trustedmicrosoftscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubeperu.org (harmfull)"; content:"|08|tubeperu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twofinestutilites.com (trojan)"; content:"|11|twofinestutilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimatepcscana.com (malicious)"; content:"|0f|ultimatepcscana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatevl.org (malicious)"; content:"|08|updatevl|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrv102.com (zeus)"; content:"|07|usrv102|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrv103.com (zeus)"; content:"|07|usrv103|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrv104.com (zeus)"; content:"|07|usrv104|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustreasurynet.com (exploit)"; content:"|0d|ustreasurynet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detector.net (malicious)"; content:"|0e|virus-detector|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusdetect24.com (rogue)"; content:"|0d|virusdetect24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusremoveonline.com (rogue)"; content:"|11|virusremoveonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antispyware.com (rogue)"; content:"|0f|web-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100creativeideas.cn (malicious)"; content:"|10|100creativeideas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10y10.com (malicious)"; content:"|05|10y10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2-scanner.com (malicious)"; content:"|09|2-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3-scans.com (malicious)"; content:"|07|3-scans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4-scan.com (malicious)"; content:"|06|4-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4allns.com (malicious)"; content:"|06|4allns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aboutbillgates.com (malicious)"; content:"|0e|aboutbillgates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actitech.net (malicious)"; content:"|08|actitech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanced-virus-remover2010.com (malicious)"; content:"|1a|advanced-virus-remover2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeeae.cn (malicious)"; content:"|05|aeeae|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aevalidform.com (malicious)"; content:"|0b|aevalidform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ai-studio.jp (malicious)"; content:"|09|ai-studio|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingsupersocial.com (malicious)"; content:"|12|amazingsupersocial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanmedicalproducts.us (malicious)"; content:"|17|americanmedicalproducts|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarenow.com (malicious)"; content:"|0e|antimalwarenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-scanz.com (malicious)"; content:"|0d|antispy-scanz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyinternet2.com (malicious)"; content:"|10|antispyinternet2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyinternet4.com (malicious)"; content:"|10|antispyinternet4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyinternet8.com (malicious)"; content:"|10|antispyinternet8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-scan1.com (malicious)"; content:"|0d|antivir-scan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-scano.com (malicious)"; content:"|0d|antivir-scano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-scanz.com (malicious)"; content:"|0d|antivir-scanz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup art4ukorea.com (malicious)"; content:"|0a|art4ukorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atatata.org (malicious)"; content:"|07|atatata|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attentionspyware.com (malicious)"; content:"|10|attentionspyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-checker.info (malicious)"; content:"|0c|auto-checker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanhere.com (malicious)"; content:"|0b|av-scanhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availablegambling.com (malicious)"; content:"|11|availablegambling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availablewww.com (malicious)"; content:"|0c|availablewww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avr-download.com (malicious)"; content:"|0c|avr-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup band-sites.net (malicious)"; content:"|0a|band-sites|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basesrv4.net (malicious)"; content:"|08|basesrv4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastaproject.com (malicious)"; content:"|0c|bastaproject|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bchokies.com (malicious)"; content:"|08|bchokies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdelles.com (malicious)"; content:"|07|bdelles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beprotected8.com (malicious)"; content:"|0c|beprotected8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scan-pc.org (malicious)"; content:"|0c|best-scan-pc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scan.net (malicious)"; content:"|09|best-scan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bevaccine.com (malicious)"; content:"|09|bevaccine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bharatwaves.com (malicious)"; content:"|0b|bharatwaves|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bioregionalistmovie.cn (malicious)"; content:"|13|bioregionalistmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkmedia.net (malicious)"; content:"|07|bkmedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cassie.dk (malicious)"; content:"|06|cassie|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbcbag.com (malicious)"; content:"|06|cbcbag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdmatool.com (malicious)"; content:"|08|cdmatool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chance2dance.be (malicious)"; content:"|0c|chance2dance|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheatengine.org (malicious)"; content:"|0b|cheatengine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check-files-now.com (malicious)"; content:"|0f|check-files-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheelumtech.com (malicious)"; content:"|0b|cheelumtech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearwayshield.com (malicious)"; content:"|0e|clearwayshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click-counter2.com (malicious)"; content:"|0e|click-counter2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolprojectnew.com (malicious)"; content:"|0e|coolprojectnew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crackness.com (malicious)"; content:"|09|crackness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curbmaker.biz (malicious)"; content:"|09|curbmaker|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dasho.co.uk (malicious)"; content:"|05|dasho|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup de-my-page.info (malicious)"; content:"|0a|de-my-page|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr9.com (malicious)"; content:"|0c|downloadavr9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ec-sportsweb.com (malicious)"; content:"|0c|ec-sportsweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecdrums.com (malicious)"; content:"|07|ecdrums|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exodus130.com (malicious)"; content:"|09|exodus130|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expressmediaplugin.com (malicious)"; content:"|12|expressmediaplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup factmediacenter.com (malicious)"; content:"|0f|factmediacenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatfreeonline.com (malicious)"; content:"|0d|fatfreeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffwbcwashington.org (malicious)"; content:"|0f|ffwbcwashington|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filetransfer.ro (malicious)"; content:"|0c|filetransfer|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmjournal.net (malicious)"; content:"|0b|filmjournal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstantispy2.com (malicious)"; content:"|0d|firstantispy2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.project-epic.com (malicious)"; content:"|05|forum|0c|project-epic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freechinaonline.com (malicious)"; content:"|0f|freechinaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freehotvid.ru (malicious)"; content:"|0a|freehotvid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fundkb.ru (malicious)"; content:"|06|fundkb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuziongraphics.com (malicious)"; content:"|0e|fuziongraphics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalsuperonline.com (malicious)"; content:"|11|globalsuperonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldtechonline.net (malicious)"; content:"|0e|goldtechonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-antispy7.com (malicious)"; content:"|0d|good-antispy7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodkinoutilities.net (malicious)"; content:"|11|goodkinoutilities|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodstonetubes.net (malicious)"; content:"|0e|goodstonetubes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goog-le.ru (malicious)"; content:"|07|goog-le|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googep.com (malicious)"; content:"|06|googep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googie-anaitlcs.ws (malicious)"; content:"|0f|googie-anaitlcs|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analystisc.com (malicious)"; content:"|11|google-analystisc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorbitasnn.cn (malicious)"; content:"|0a|gorbitasnn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatcrypt.com (malicious)"; content:"|0a|greatcrypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatns.com (malicious)"; content:"|07|greatns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatonlineguide.com (malicious)"; content:"|10|greatonlineguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattestprep.com (malicious)"; content:"|0d|greattestprep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardsystem-scanner.net (malicious)"; content:"|13|guardsystem-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gvbsoftware.com (malicious)"; content:"|0b|gvbsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happytata.com (malicious)"; content:"|09|happytata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hast-eg.com (malicious)"; content:"|07|hast-eg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haztek-software.com (malicious)"; content:"|0f|haztek-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hentaiarmy.com (malicious)"; content:"|0a|hentaiarmy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heroesmultimedia.com (malicious)"; content:"|10|heroesmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hold-onyourzonescan.com (malicious)"; content:"|13|hold-onyourzonescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hold-onyourzonescan.net (malicious)"; content:"|13|hold-onyourzonescan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdon-yourzonescan.com (malicious)"; content:"|13|holdon-yourzonescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdon-yourzonescan.net (malicious)"; content:"|13|holdon-yourzonescan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyour-zonescan.com (malicious)"; content:"|13|holdonyour-zonescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyour-zonescan.net (malicious)"; content:"|13|holdonyour-zonescan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyourzone-scan.com (malicious)"; content:"|13|holdonyourzone-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyourzone-scan.net (malicious)"; content:"|13|holdonyourzone-scan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyourzonescan.com (malicious)"; content:"|12|holdonyourzonescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdonyourzonescan.net (malicious)"; content:"|12|holdonyourzonescan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homelezo.info (malicious)"; content:"|08|homelezo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmodders.com (malicious)"; content:"|0a|hotmodders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i-finally-found.cn (malicious)"; content:"|0f|i-finally-found|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indiatouragency.com (malicious)"; content:"|0f|indiatouragency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup information-technology-news.ru (malicious)"; content:"|1b|information-technology-news|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup install.divocodec.com (malicious)"; content:"|07|install|09|divocodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instantmovieplugin.net (malicious)"; content:"|12|instantmovieplugin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup invoiceclinton.com (malicious)"; content:"|0e|invoiceclinton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup japimen.net (gumblar)"; content:"|07|japimen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kangaroocar.cn (malicious)"; content:"|0b|kangaroocar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup levitationwonder.cn (malicious)"; content:"|10|levitationwonder|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lmageshak.us (malicious)"; content:"|09|lmageshak|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loaddd.com (malicious)"; content:"|06|loaddd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovestoryy.cn (malicious)"; content:"|0a|lovestoryy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maindavinchi.com (malicious)"; content:"|0c|maindavinchi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makingtmoneygateway.info (malicious)"; content:"|13|makingtmoneygateway|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scan.biz (malicious)"; content:"|0c|malware-scan|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareprotectionz.com (malicious)"; content:"|12|malwareprotectionz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaeldorado.com (malicious)"; content:"|0d|mediaeldorado|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediatoolsarea.com (malicious)"; content:"|0e|mediatoolsarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megacryptnew.com (malicious)"; content:"|0c|megacryptnew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megainvest.cn (malicious)"; content:"|0a|megainvest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minnesinger2.cn (malicious)"; content:"|0c|minnesinger2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moreflashmedia.com (malicious)"; content:"|0e|moreflashmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtm4cbk.info (malicious)"; content:"|07|mtm4cbk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaanalyze.com (malicious)"; content:"|11|multimediaanalyze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediacheck.com (malicious)"; content:"|0f|multimediacheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaprivate.net (malicious)"; content:"|11|multimediaprivate|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaregion.net (malicious)"; content:"|10|multimediaregion|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediasecret.com (malicious)"; content:"|10|multimediasecret|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediatechinc.net (malicious)"; content:"|11|multimediatechinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup must-scanzonenow.com (malicious)"; content:"|10|must-scanzonenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup must-scanzonenow.net (malicious)"; content:"|10|must-scanzonenow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscan-zonenow.com (malicious)"; content:"|10|mustscan-zonenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscan-zonenow.net (malicious)"; content:"|10|mustscan-zonenow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscanzone-now.com (malicious)"; content:"|10|mustscanzone-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscanzone-now.net (malicious)"; content:"|10|mustscanzone-now|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscanzonenow.com (malicious)"; content:"|0f|mustscanzonenow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustscanzonenow.net (malicious)"; content:"|0f|mustscanzonenow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-oyster.cn (malicious)"; content:"|09|my-oyster|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myavidity.cn (malicious)"; content:"|09|myavidity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myflashmultimedia.com (malicious)"; content:"|11|myflashmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoscanner3.com (malicious)"; content:"|0c|nanoscanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-remover.com (malicious)"; content:"|16|online-spyware-remover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-remover.net (malicious)"; content:"|16|online-spyware-remover|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinechipguide.com (malicious)"; content:"|0f|onlinechipguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubeporn.com (malicious)"; content:"|0e|onlinetubeporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubeporn.net (malicious)"; content:"|0e|onlinetubeporn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineworldcar.com (malicious)"; content:"|0e|onlineworldcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineworldclub.com (malicious)"; content:"|0f|onlineworldclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineworldtech.com (malicious)"; content:"|0f|onlineworldtech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partmultimedia.net (malicious)"; content:"|0e|partmultimedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paycyberbill.com (malicious)"; content:"|0c|paycyberbill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcecologist.com (malicious)"; content:"|0b|pcecologist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfect-security11.com (malicious)"; content:"|12|perfect-security11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfect-security3.com (malicious)"; content:"|11|perfect-security3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectsoft.info (malicious)"; content:"|0b|perfectsoft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalguard-2009.com (malicious)"; content:"|12|personalguard-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup placability.cn (malicious)"; content:"|0b|placability|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powertoolsproductions.com (malicious)"; content:"|15|powertoolsproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preciousmultimedia.com (malicious)"; content:"|12|preciousmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proofdefender2009.com (malicious)"; content:"|11|proofdefender2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptsoftwarellc.com (malicious)"; content:"|0d|ptsoftwarellc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickscansecurity.cn (malicious)"; content:"|11|quickscansecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtydesk.ru (malicious)"; content:"|0a|realtydesk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rivatech.co.za (malicious)"; content:"|08|rivatech|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetransferonline.com (malicious)"; content:"|12|safetransferonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safety-updated.com (rogue)"; content:"|0e|safety-updated|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samed-resort.com (malicious)"; content:"|0c|samed-resort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-malware.net (malicious)"; content:"|0c|scan-malware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchradar.org (malicious)"; content:"|0b|searchradar|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepaysite.com (malicious)"; content:"|0d|securepaysite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seguroecompleto.com (threat)"; content:"|0f|seguroecompleto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seyzones.cn (malicious)"; content:"|08|seyzones|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smaug.cz (malicious)"; content:"|05|smaug|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snapemotorcompany.org.uk (malicious)"; content:"|11|snapemotorcompany|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softset.ro (malicious)"; content:"|07|softset|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-online-remover.com (malicious)"; content:"|16|spyware-online-remover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-online-remover.net (malicious)"; content:"|16|spyware-online-remover|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-scanz.com (malicious)"; content:"|0d|spyware-scanz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sqlinfotech.com (malicious)"; content:"|0b|sqlinfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storeonlineguide.com (malicious)"; content:"|10|storeonlineguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stroydetal.crimea.ua (malicious)"; content:"|0a|stroydetal|06|crimea|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summaryscansecurity.cn (malicious)"; content:"|13|summaryscansecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunderman.nl (malicious)"; content:"|09|sunderman|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superavailable.com (malicious)"; content:"|0e|superavailable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superonlinedirect.com (malicious)"; content:"|11|superonlinedirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-searchandscan.com (malicious)"; content:"|14|system-searchandscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-searchandscan.net (malicious)"; content:"|14|system-searchandscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemmdefender.com (malicious)"; content:"|0f|systemmdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemmguard.com (malicious)"; content:"|0c|systemmguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemsearchandscan.com (malicious)"; content:"|13|systemsearchandscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemsearchandscan.net (malicious)"; content:"|13|systemsearchandscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tacticz.be (malicious)"; content:"|07|tacticz|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talkshoponline.com (malicious)"; content:"|0e|talkshoponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techno-rescue.com (malicious)"; content:"|0d|techno-rescue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teessidetrailerhire.co.uk (malicious)"; content:"|13|teessidetrailerhire|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testsitesam.com (malicious)"; content:"|0b|testsitesam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-experts-review.com (malicious)"; content:"|12|the-experts-review|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantimalware.com (malicious)"; content:"|0e|theantimalware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theflashplugin.net (malicious)"; content:"|0e|theflashplugin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegreatdadventure.com (malicious)"; content:"|12|thegreatdadventure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepascoedifference.com (malicious)"; content:"|13|thepascoedifference|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetoolsdiscount.com (malicious)"; content:"|10|thetoolsdiscount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup this-is-protection.com (malicious)"; content:"|12|this-is-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tolzcoolz.cn (malicious)"; content:"|09|tolzcoolz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbillpay.com (malicious)"; content:"|0a|topbillpay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topig12ma.in (malicious)"; content:"|09|topig12ma|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trusted-security3.com (malicious)"; content:"|11|trusted-security3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tssauto.ru (malicious)"; content:"|07|tssauto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornonline.com (malicious)"; content:"|0e|tubepornonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornonline.net (malicious)"; content:"|0e|tubepornonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tv-world-online.net (malicious)"; content:"|0f|tv-world-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upp100km.se (malicious)"; content:"|08|upp100km|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urmantseva.ru (malicious)"; content:"|0a|urmantseva|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vanilla-resort.jp (malicious)"; content:"|0e|vanilla-resort|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vectorplugin.com (malicious)"; content:"|0c|vectorplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verycd.com (malicious)"; content:"|06|verycd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vida-soft.net (malicious)"; content:"|09|vida-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virgin-x.com (malicious)"; content:"|08|virgin-x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-quickscan-2009.com (malicious)"; content:"|14|virus-quickscan-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vlachosoft.com (malicious)"; content:"|0a|vlachosoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vscodec-pro.net (malicious)"; content:"|0b|vscodec-pro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvvcr.cn (malicious)"; content:"|05|vvvcr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbillcheck.com (malicious)"; content:"|0c|webbillcheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weddinglimosperth.com.au (malicious)"; content:"|11|weddinglimosperth|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weekendgolf.net (malicious)"; content:"|0b|weekendgolf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wegenerinfo.cn (malicious)"; content:"|0b|wegenerinfo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wholemanministries.net (malicious)"; content:"|12|wholemanministries|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-antimalware2.com (malicious)"; content:"|10|win-antimalware2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-antimalwarea.com (malicious)"; content:"|10|win-antimalwarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-antimalwarez.com (malicious)"; content:"|10|win-antimalwarez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-antispy2.com (malicious)"; content:"|0c|win-antispy2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-antispya.com (malicious)"; content:"|0c|win-antispya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-script.com (malicious)"; content:"|0e|windows-script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsadditionalguard.net (malicious)"; content:"|16|windowsadditionalguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsenterprisesuite.net (malicious)"; content:"|16|windowsenterprisesuite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowssp3download.com (threat)"; content:"|12|windowssp3download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwdot.info (malicious)"; content:"|05|wwdot|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwanti-malware.com (malicious)"; content:"|0f|wwwanti-malware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhxoo.com (malicious)"; content:"|05|yhxoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtoolscheap.com (malicious)"; content:"|0e|yourtoolscheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuming.flnet.org (malicious)"; content:"|06|yuming|05|flnet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zangmusic.com (malicious)"; content:"|09|zangmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeromediaplugin.com (malicious)"; content:"|0f|zeromediaplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonemediafiles.com (malicious)"; content:"|0e|zonemediafiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ztgsoftware.com (malicious)"; content:"|0b|ztgsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zupde.com (malicious)"; content:"|05|zupde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zvonesrv.cn (malicious)"; content:"|08|zvonesrv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abc-webdesign.cn (moneymule)"; content:"|0d|abc-webdesign|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup account.net.in (malware)"; content:"|07|account|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup add-pay.ru (malicious)"; content:"|07|add-pay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware-pro-2009.com (malicious)"; content:"|0f|adware-pro-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware-pro-site.org (malicious)"; content:"|0f|adware-pro-site|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinonescan3.com (scareware)"; content:"|0d|allinonescan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allshoponline.com (scareware)"; content:"|0d|allshoponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-software.com (malicious)"; content:"|14|antimalware-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live-software.com (malicious)"; content:"|17|antivirus-live-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pro-live.com (malicious)"; content:"|12|antivirus-pro-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-wizard.com (malicious)"; content:"|10|antivirus-wizard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antydetectivewares.com (scareware)"; content:"|12|antydetectivewares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyoperativewares.com (malicious)"; content:"|12|antyoperativewares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspygoods.com (scareware)"; content:"|0c|antyspygoods|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspyproducts.com (scareware)"; content:"|0f|antyspyproducts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspywaresshop.com (scareware)"; content:"|10|antyspywaresshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auditexperiment.com (scareware)"; content:"|0f|auditexperiment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autoactionsoftware.com (malicious)"; content:"|12|autoactionsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-test-here.net (scareware)"; content:"|0c|av-test-here|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aweleon.com (waledac)"; content:"|07|aweleon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badcheckalert.com (malicious)"; content:"|0d|badcheckalert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttubescan.com (malicious)"; content:"|0c|besttubescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttubesworld.com (malicious)"; content:"|0e|besttubesworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttubetop.com (malicious)"; content:"|0b|besttubetop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttubeworld.net (malicious)"; content:"|0d|besttubeworld|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestviruskillera.com (malicious)"; content:"|10|bestviruskillera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestviruskillert.com (malicious)"; content:"|10|bestviruskillert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestviruskillerz.com (malicious)"; content:"|10|bestviruskillerz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigmediastorage.com (malicious)"; content:"|0f|bigmediastorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdab.com (waledac)"; content:"|06|birdab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluestarmultimedia.com (malicious)"; content:"|12|bluestarmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brand-scanner4.com (scareware)"; content:"|0e|brand-scanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bu520.com (malicious)"; content:"|05|bu520|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cabellowrecker.com (malicious)"; content:"|0e|cabellowrecker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canprotools.com (malicious)"; content:"|0b|canprotools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capoeirakayseri.com (malicious)"; content:"|0f|capoeirakayseri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cathrynzfunz.com (scareware)"; content:"|0c|cathrynzfunz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chargefish.com (scareware)"; content:"|0a|chargefish|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check4threats.com (malicious)"; content:"|0d|check4threats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkexperiment.com (scareware)"; content:"|0f|checkexperiment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checksafecard.com (scareware)"; content:"|0d|checksafecard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cismosis.com (waledac)"; content:"|08|cismosis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolcount1.com (scareware)"; content:"|0a|coolcount1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corlock.net (malware)"; content:"|07|corlock|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazyrats.nl (malicious)"; content:"|09|crazyrats|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cycloro.com (waledac)"; content:"|07|cycloro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cysha.com (malicious)"; content:"|05|cysha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dapohsoft.in (scareware)"; content:"|09|dapohsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daposoft.in (scareware)"; content:"|08|daposoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designsoftwaresite.com (scareware)"; content:"|12|designsoftwaresite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dexteracreations.com (Koobface)"; content:"|10|dexteracreations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dglbahamassc.com (Koobface)"; content:"|0c|dglbahamassc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondfever.com (Koobface)"; content:"|0c|diamondfever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalimpressionist.com (Koobface)"; content:"|14|digitalimpressionist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup distrilamadrid.com.ar (RFI)"; content:"|0e|distrilamadrid|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup div-x.ws (malicious)"; content:"|05|div-x|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diwa.se (malicious)"; content:"|04|diwa|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dl.woyo8g.com (trojan)"; content:"|02|dl|06|woyo8g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doroszewicz-clausen.com (RFI)"; content:"|13|doroszewicz-clausen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dorothycooley.com (Koobface)"; content:"|0d|dorothycooley|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.woyo8g.com (trojan)"; content:"|04|down|06|woyo8g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr8.com (scareware)"; content:"|0c|downloadavr8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadsetup.org (malicious)"; content:"|0d|downloadsetup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dudicohen.linuxserv.co.il (Koobface)"; content:"|09|dudicohen|09|linuxserv|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdprotools.com (scareware)"; content:"|0b|dvdprotools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dx.woyo8g.com (trojan)"; content:"|02|dx|06|woyo8g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elowride.com (malicious)"; content:"|08|elowride|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emrahkeskin.com (malicious)"; content:"|0b|emrahkeskin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewarningsite.com (scareware)"; content:"|0c|ewarningsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f4n3upyhqj.com (botnet)"; content:"|0a|f4n3upyhqj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastloadmultimedia.com (malicious)"; content:"|12|fastloadmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashlabelsite.com (malicious)"; content:"|0e|flashlabelsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashsoftname.com (malicious)"; content:"|0d|flashsoftname|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forceairtools.com (scareware)"; content:"|0d|forceairtools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyspywares.com (malicious)"; content:"|10|freeantyspywares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeemailnow.net (scam)"; content:"|0c|freeemailnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gameonlinesite.com (scareware)"; content:"|0e|gameonlinesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfase.be (fastflux)"; content:"|07|gerfase|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfaso.be (fastflux)"; content:"|07|gerfaso|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfasr.be (fastflux)"; content:"|07|gerfasr|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfasx.be (fastflux)"; content:"|07|gerfasx|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerfasy.be (fastflux)"; content:"|07|gerfasy|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gipfelsturm-scuba-diving.at (Koobface)"; content:"|18|gipfelsturm-scuba-diving|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scan001.com (malicious)"; content:"|0a|go-scan001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scan003.com (malicious)"; content:"|0a|go-scan003|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scan006.com (malicious)"; content:"|0a|go-scan006|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scanyoursystem.com (malicious)"; content:"|11|go-scanyoursystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-scanyoursystem.net (malicious)"; content:"|11|go-scanyoursystem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-systemprotection.net (malicious)"; content:"|13|go-systemprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-xxx-tube.com (scareware)"; content:"|0d|hard-xxx-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homemadesandwiches.com (malicious)"; content:"|12|homemadesandwiches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesoftwareonline.com (malicious)"; content:"|12|homesoftwareonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hometeaminspect.com (scareware)"; content:"|0f|hometeaminspect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honeywell-cn.cn (malicious)"; content:"|0c|honeywell-cn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-tubsandmore.com (Koobface)"; content:"|0f|hot-tubsandmore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugemoviestorage.net (malicious)"; content:"|10|hugemoviestorage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imc-krefeld.de (malicious)"; content:"|0b|imc-krefeld|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innkeyhr.net (malicious)"; content:"|08|innkeyhr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jassportfolio.se (malicious)"; content:"|0d|jassportfolio|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juha8uta.cn (malicious)"; content:"|08|juha8uta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwgqkqxn.cn (malicious)"; content:"|08|kwgqkqxn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l2yes.biz (exploit)"; content:"|05|l2yes|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup market-stabl.ru (malicious)"; content:"|0c|market-stabl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msnupdateserver.info (malicious)"; content:"|0f|msnupdateserver|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediarainbow.com (malicious)"; content:"|11|multimediarainbow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediareload.net (malicious)"; content:"|10|multimediareload|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecurity-suite.com (scareware)"; content:"|10|mysecurity-suite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoscan6.com (scareware)"; content:"|09|nanoscan6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup northstarsocal.com (malicious)"; content:"|0e|northstarsocal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlyomne.com (scareware)"; content:"|08|onlyomne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup painkee.com (waledac)"; content:"|07|painkee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pantali.com (waledac)"; content:"|07|pantali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pathoph.com (waledac)"; content:"|07|pathoph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phil-soft-center.com (malicious)"; content:"|10|phil-soft-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promozzmoon4.info (malicious)"; content:"|0c|promozzmoon4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-yourself3.com (malicious)"; content:"|11|protect-yourself3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectionsuite.net (scareware)"; content:"|0f|protectionsuite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rascop.com (waledac)"; content:"|06|rascop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup re-active.net (Koobface)"; content:"|09|re-active|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rollingwithrubicon.com (malicious)"; content:"|12|rollingwithrubicon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan.gikolali.cn (scareware)"; content:"|04|scan|08|gikolali|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan.teenntre.cn (scareware)"; content:"|04|scan|08|teenntre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsblog.com (malicious)"; content:"|11|securitytoolsblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsclick.com (malicious)"; content:"|12|securitytoolsclick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsexist.com (malicious)"; content:"|12|securitytoolsexist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsfilter.com (malicious)"; content:"|13|securitytoolsfilter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolslisted.com (malicious)"; content:"|13|securitytoolslisted|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsmenu.com (malicious)"; content:"|11|securitytoolsmenu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsnow.com (malicious)"; content:"|10|securitytoolsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsquotes.com (malicious)"; content:"|13|securitytoolsquotes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsshop.com (malicious)"; content:"|11|securitytoolsshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsstore.com (malicious)"; content:"|12|securitytoolsstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsthanks.com (malicious)"; content:"|13|securitytoolsthanks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolstoday.com (malicious)"; content:"|12|securitytoolstoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolstool.com (malicious)"; content:"|11|securitytoolstool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsuser.com (malicious)"; content:"|11|securitytoolsuser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selfrental.co.uk (Koobface)"; content:"|0a|selfrental|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sergej-nagovicin.ru (malicious)"; content:"|10|sergej-nagovicin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shurus.net (malware)"; content:"|06|shurus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sixlice.com (scareware)"; content:"|07|sixlice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft0world.net (malicious)"; content:"|0a|soft0world|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specipa.com (waledac)"; content:"|07|specipa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersafetysolutions.com (malicious)"; content:"|14|supersafetysolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweet-memory.cn (malicious)"; content:"|0c|sweet-memory|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemcodec.com (malicious)"; content:"|0b|systemcodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemscan-check.com (malicious)"; content:"|10|systemscan-check|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemscan-check.net (malicious)"; content:"|10|systemscan-check|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taiabrazil.com (Koobface)"; content:"|0a|taiabrazil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup team-sleep.by.ru (malicious)"; content:"|0a|team-sleep|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technewdata.com (malicious)"; content:"|0b|technewdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempa1.cn (malicious)"; content:"|06|tempa1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempa2.cn (malicious)"; content:"|06|tempa2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempa3.cn (malicious)"; content:"|06|tempa3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testavrdownnew.com (scareware)"; content:"|0e|testavrdownnew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantyspywares.com (scareware)"; content:"|0f|theantyspywares|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theautocompany.in (trojan)"; content:"|0e|theautocompany|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebbflashplugin.com (malicious)"; content:"|10|thebbflashplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebigsoftware.com (scareware)"; content:"|0e|thebigsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebizshop.com.au (malicious)"; content:"|0a|thebizshop|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themasterengraver.com (Koobface)"; content:"|11|themasterengraver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themedallion.net (Koobface)"; content:"|0c|themedallion|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetoolsdirect.com (scareware)"; content:"|0e|thetoolsdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolskeys.cn (malicious)"; content:"|09|toolskeys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolzsite.com (scareware)"; content:"|09|toolzsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usertoolbars.cn (malicious)"; content:"|0c|usertoolbars|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utilitiesdiscounts.com (scareware)"; content:"|12|utilitiesdiscounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsproject.net (scareware)"; content:"|09|vsproject|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webtec.gr (malicious)"; content:"|06|webtec|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whippeddreams.net (Koobface)"; content:"|0d|whippeddreams|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woorizip1004.net (RFI)"; content:"|0c|woorizip1004|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woudstravogel.nl (Koobface)"; content:"|0d|woudstravogel|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woyo8g.com (trojan)"; content:"|06|woyo8g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpointenemy.com (malicious)"; content:"|0b|xpointenemy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxx-white-tube.org (scareware)"; content:"|0e|xxx-white-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykdju27be4.com (botnet)"; content:"|0a|ykdju27be4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourkidssecurity.com (scareware)"; content:"|10|yourkidssecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1tomohappy.com (trojan)"; content:"|0a|1tomohappy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2009securitycenter.in (malicious)"; content:"|12|2009securitycenter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4pppp.com (rfi)"; content:"|05|4pppp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 800doctor.cl (koobface)"; content:"|09|800doctor|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaasublet.com (koobface)"; content:"|09|aaasublet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abratec1.tempsite.ws (rfi)"; content:"|08|abratec1|08|tempsite|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup achieve21121.cn (trojan)"; content:"|0c|achieve21121|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acminc.net (koobface)"; content:"|06|acminc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admcp21.cn (zeus)"; content:"|07|admcp21|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advance.com.my (koobface)"; content:"|07|advance|03|com|02|my"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aegypten-mit-stefan.de (koobface)"; content:"|13|aegypten-mit-stefan|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeomailer028.com (fastflux)"; content:"|0c|aeomailer028|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeroninc.com (malicious)"; content:"|08|aeroninc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agalzoff.com (koobface)"; content:"|08|agalzoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agr255.cne-escutismo.pt (koobface)"; content:"|06|agr255|0d|cne-escutismo|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alavench.com (koobface)"; content:"|08|alavench|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alerytfix.com (trojan)"; content:"|09|alerytfix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alkeichah.com (worm)"; content:"|09|alkeichah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allprotection6.com (malicious)"; content:"|0e|allprotection6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allprotectiona2.com (malicious)"; content:"|0f|allprotectiona2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allprotectiona3.com (malicious)"; content:"|0f|allprotectiona3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alm7aba.com (malicious)"; content:"|07|alm7aba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almullahotels.com (koobface)"; content:"|0d|almullahotels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andrewberggren.net (rfi)"; content:"|0e|andrewberggren|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aphobos.info (koobface)"; content:"|07|aphobos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arabco.in (koobface)"; content:"|06|arabco|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arabcologistic.com (koobface)"; content:"|0e|arabcologistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arlingtonlocksmith.us (koobface)"; content:"|12|arlingtonlocksmith|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arrowheadultra.com (koobface)"; content:"|0e|arrowheadultra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup austria-skitest.com (rfi)"; content:"|0f|austria-skitest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autobanat.co.rs (malicious)"; content:"|09|autobanat|02|co|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autobedrijfstolwijk.nl (koobface)"; content:"|13|autobedrijfstolwijk|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avisuallandscaping.com (zeus)"; content:"|12|avisuallandscaping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avnstrupoverdrev.dk (koobface)"; content:"|10|avnstrupoverdrev|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avtodrom.rv.ua (zeus)"; content:"|08|avtodrom|02|rv|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awardsmenen.be (rfi)"; content:"|0b|awardsmenen|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awawu.com (zeus)"; content:"|05|awawu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axbprojects.com (koobface)"; content:"|0b|axbprojects|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aya-multimedia.co.cc (koobface)"; content:"|0e|aya-multimedia|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barcoaching.de (koobface)"; content:"|0b|barcoaching|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastakigroup.com (koobface)"; content:"|0c|bastakigroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbexe.cn (trojan)"; content:"|05|bbexe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bchampion.com (koobface)"; content:"|09|bchampion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdesata.com (trojan)"; content:"|07|bdesata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bespokekennels.co.uk (malicious)"; content:"|0e|bespokekennels|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispysoft2010.com (malicious)"; content:"|13|bestantispysoft2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birdystudio.com (koobface)"; content:"|0b|birdystudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blueseven.com.br (malicious)"; content:"|09|blueseven|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bordersecuritytools.com (malicious)"; content:"|13|bordersecuritytools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brennansofwiltshire.co.uk (koobface)"; content:"|13|brennansofwiltshire|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brooksinfotech.com (koobface)"; content:"|0e|brooksinfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubibaba.cn (zeus)"; content:"|08|bubibaba|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bymusti.net (rfi)"; content:"|07|bymusti|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cabeloduro.org (rfi)"; content:"|0a|cabeloduro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canalaovivo.xpg.com.br (rfi)"; content:"|0b|canalaovivo|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cash-inferno.de (koobface)"; content:"|0c|cash-inferno|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceramicrestoration.co.za (koobface)"; content:"|12|ceramicrestoration|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chance-car.ru (malicious)"; content:"|0a|chance-car|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chemo-couture.com (rfi)"; content:"|0d|chemo-couture|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chimera-crew.de (koobface)"; content:"|0c|chimera-crew|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chromecoat.dk (koobface)"; content:"|0a|chromecoat|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup church.co.kr (rfi)"; content:"|06|church|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cold-achieve21121.cn (malicious)"; content:"|11|cold-achieve21121|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collectible-trading.com (koobface)"; content:"|13|collectible-trading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conference-professionals.com (koobface)"; content:"|18|conference-professionals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consignbuydesign.com (koobface)"; content:"|10|consignbuydesign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counterstrikefc.com (malicious)"; content:"|0f|counterstrikefc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crescenthorizons.com (koobface)"; content:"|10|crescenthorizons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curztech.com (rfi)"; content:"|08|curztech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customizeyourstory.com (koobface)"; content:"|12|customizeyourstory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d-dmusic.com (koobface)"; content:"|08|d-dmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailynews7x24.com (malicious)"; content:"|0d|dailynews7x24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dance-alarm.de (koobface)"; content:"|0b|dance-alarm|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data0rder.net (zeus)"; content:"|09|data0rder|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dawnofmetal.at (koobface)"; content:"|0b|dawnofmetal|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daysinparadise.at (malicious)"; content:"|0e|daysinparadise|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delicesevdam.net (koobface)"; content:"|0c|delicesevdam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desirevandoorne.nl (koobface)"; content:"|0f|desirevandoorne|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzzrenjanin.rs (koobface)"; content:"|0b|dzzrenjanin|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emeraldsunarts.com (koobface)"; content:"|0e|emeraldsunarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emeters.co.za (koobface)"; content:"|07|emeters|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escorthosting.biz (zeus)"; content:"|0d|escorthosting|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europasia.com.my (koobface)"; content:"|09|europasia|03|com|02|my"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurorscgabc-space.de (koobface)"; content:"|11|eurorscgabc-space|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup express-translations.de (koobface)"; content:"|14|express-translations|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facilicaresavannah.com (koobface)"; content:"|12|facilicaresavannah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fag-clan.net (koobface)"; content:"|08|fag-clan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fallsmediaproductions.com (koobface)"; content:"|15|fallsmediaproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file.power-sale.co.kr (trojan)"; content:"|04|file|0a|power-sale|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flying-multimedia.de (malicious)"; content:"|11|flying-multimedia|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folcon-mex.com (koobface)"; content:"|0a|folcon-mex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foo6.com (koobface)"; content:"|04|foo6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxlink.net (malicious)"; content:"|07|foxlink|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fraghouse.ichclan.at (koobface)"; content:"|09|fraghouse|07|ichclan|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futurenetwork.com.br (rfi)"; content:"|0d|futurenetwork|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gacogop.org (koobface)"; content:"|07|gacogop|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gecahe.com (koobface)"; content:"|06|gecahe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold3-1gf1b.ws (zeus)"; content:"|0b|gold3-1gf1b|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodflashsource.com (malicious)"; content:"|0f|goodflashsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gospel-force.com (koobface)"; content:"|0c|gospel-force|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graphwebgo.cn (trojan)"; content:"|0a|graphwebgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatsafetysystems.com (malicious)"; content:"|12|greatsafetysystems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grubdango.com (koobface)"; content:"|09|grubdango|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hallum.eu (koobface)"; content:"|06|hallum|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herwsx.com (fastflux)"; content:"|06|herwsx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hillsdemocrat.com (koobface)"; content:"|0d|hillsdemocrat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hipspeople.com (koobface)"; content:"|0a|hipspeople|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hl-d.co.il (koobface)"; content:"|04|hl-d|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ho-fashion.com (koobface)"; content:"|0a|ho-fashion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotgirldream.net (malware)"; content:"|0c|hotgirldream|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hreesf.co.im (fastflux)"; content:"|06|hreesf|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hreesf.org.im (fastflux)"; content:"|06|hreesf|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hreesv.co.im (fastflux)"; content:"|06|hreesv|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huette-ohmden.de (koobface)"; content:"|0d|huette-ohmden|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikant.co.kr (rfi)"; content:"|05|ikant|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup improvisedjams.co.uk (koobface)"; content:"|0e|improvisedjams|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indigozeus1.net (malicious)"; content:"|0b|indigozeus1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoleaf.com (koobface)"; content:"|08|infoleaf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insideout-construction.com (koobface)"; content:"|16|insideout-construction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integrastor.com (koobface)"; content:"|0b|integrastor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetpasswordrecovery.com (malicious)"; content:"|18|internetpasswordrecovery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ircbelem.com (rfi)"; content:"|08|ircbelem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irentphotobooths.com (koobface)"; content:"|10|irentphotobooths|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irminsulchoppers.se (koobface)"; content:"|10|irminsulchoppers|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isorecordernn.ru (zeus)"; content:"|0d|isorecordernn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it4net.com (koobface)"; content:"|06|it4net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup italianostracastiglionedellapescaia.it (koobface)"; content:"|23|italianostracastiglionedellapescaia|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuoket.org.uk (fastflux)"; content:"|06|iuoket|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacrafts.com (rfi)"; content:"|08|jacrafts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jazz-brewery.com (koobface)"; content:"|0c|jazz-brewery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjdd.co.kr (rfi)"; content:"|04|jjdd|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnhsolutions.com.au (rfi)"; content:"|0c|jnhsolutions|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joomla.kingdomchristianity.com (koobface)"; content:"|06|joomla|13|kingdomchristianity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juanfurlan.com.ar (koobface)"; content:"|0a|juanfurlan|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justanotherwebhosting.com (zeus)"; content:"|15|justanotherwebhosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keeplan.com (malicious)"; content:"|07|keeplan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kennywest.mooo.com (zeus)"; content:"|09|kennywest|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kickwithcolors.com (koobface)"; content:"|0e|kickwithcolors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kindaanzet.nl (koobface)"; content:"|0a|kindaanzet|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjf-holzminden.de (rfi)"; content:"|0e|kjf-holzminden|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klyop-sanya.narod.ru (malicious)"; content:"|0b|klyop-sanya|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kronosagency.com (koobface)"; content:"|0c|kronosagency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamsmotorsports.com (koobface)"; content:"|0f|lamsmotorsports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastuacoe.it (rfi)"; content:"|09|lastuacoe|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lebonresto.fr (koobface)"; content:"|0a|lebonresto|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leonfamilia.com (koobface)"; content:"|0b|leonfamilia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lineaidea.it (koobface)"; content:"|09|lineaidea|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkuwant.com (rfi)"; content:"|09|linkuwant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locotailgaters.com (koobface)"; content:"|0e|locotailgaters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logequip.com (malicious)"; content:"|08|logequip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logica-tech.com (rfi)"; content:"|0b|logica-tech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luvyadating.com (rfi)"; content:"|0b|luvyadating|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magespages.com (koobface)"; content:"|0a|magespages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malath.com.sa (koobface)"; content:"|06|malath|03|com|02|sa"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup markandrews.net (rfi)"; content:"|0b|markandrews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mathey.com.au (koobface)"; content:"|06|mathey|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matthall.com.au (koobface)"; content:"|08|matthall|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediam.ro (malicious)"; content:"|06|mediam|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megabesucher.eu (koobface)"; content:"|0c|megabesucher|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microfreelance.cn (malicious)"; content:"|0e|microfreelance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missionoch.org (koobface)"; content:"|0a|missionoch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motorpsyk.dk (koobface)"; content:"|09|motorpsyk|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movehits.at (koobface)"; content:"|08|movehits|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mpisqlhosting.com (malicious)"; content:"|0d|mpisqlhosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msfreesoftware.com (malicious)"; content:"|0e|msfreesoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murimkhan.com (rfi)"; content:"|09|murimkhan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musikskolan.orsa.se (koobface)"; content:"|0b|musikskolan|04|orsa|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musthaveitjewelry.com.mytempweb.com (koobface)"; content:"|11|musthaveitjewelry|03|com|09|mytempweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzevs.cn (malicious)"; content:"|06|myzevs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namukulu-motel.com (koobface)"; content:"|0e|namukulu-motel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nancy-woodward.com (koobface)"; content:"|0e|nancy-woodward|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natali.sk (koobface)"; content:"|06|natali|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nedelnilide.cz (koobface)"; content:"|0b|nedelnilide|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettelplus.com (koobface)"; content:"|0a|nettelplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oemsoftwarediscounter.com (malicious)"; content:"|15|oemsoftwarediscounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup offseasonstudio.com (koobface)"; content:"|0f|offseasonstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omegacomputersllc.com (koobface)"; content:"|11|omegacomputersllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinepcwizard.com (koobface)"; content:"|0e|onlinepcwizard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outtouch.org (malicious)"; content:"|08|outtouch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup packagebusiness.com (malicious)"; content:"|0f|packagebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palmtev.hu (koobface)"; content:"|07|palmtev|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradisenj.com (koobface)"; content:"|0a|paradisenj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passionim.org (koobface)"; content:"|09|passionim|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patriotflag.org (malicious)"; content:"|0b|patriotflag|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peace-data.cn (exploit)"; content:"|0a|peace-data|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peakgrouptravel.com (koobface)"; content:"|0f|peakgrouptravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfumedesire.com (malicious)"; content:"|0d|perfumedesire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plastischechirurgie-web.de (koobface)"; content:"|17|plastischechirurgie-web|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmvideo.net (malicious)"; content:"|07|pmvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pokeherstars.com (koobface)"; content:"|0c|pokeherstars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pokerne.ws (koobface)"; content:"|07|pokerne|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pradsuyz.cn (malicious)"; content:"|08|pradsuyz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup print-design.cn (malicious)"; content:"|0c|print-design|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prostruction.net (koobface)"; content:"|0c|prostruction|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pwsd1pc.org (koobface)"; content:"|07|pwsd1pc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qatar-business-guide.net (koobface)"; content:"|14|qatar-business-guide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rafwa.com (malicious)"; content:"|05|rafwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramanvk.com (koobface)"; content:"|07|ramanvk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readysetcargo.at (koobface)"; content:"|0d|readysetcargo|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup records.extra.hu (malicious)"; content:"|07|records|05|extra|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redcode.rs (koobface)"; content:"|07|redcode|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reishus.de (koobface)"; content:"|07|reishus|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remainstill.cn (malicious)"; content:"|0b|remainstill|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remodelclarksville.com (koobface)"; content:"|12|remodelclarksville|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup republicdemocracy.cn (trojan)"; content:"|11|republicdemocracy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resbuszone.com (malicious)"; content:"|0a|resbuszone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup respyware.com (trojan)"; content:"|09|respyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robertomoran.com (koobface)"; content:"|0c|robertomoran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockvillelocksmith.net (koobface)"; content:"|12|rockvillelocksmith|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royaldefensescana.com (malicious)"; content:"|11|royaldefensescana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rub-a-dub.de (koobface)"; content:"|09|rub-a-dub|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russkiytoy.at (koobface)"; content:"|0a|russkiytoy|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryanscarter.com (koobface)"; content:"|0b|ryanscarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sambapanashe.com (koobface)"; content:"|0c|sambapanashe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samplermovie.cn (malicious)"; content:"|0c|samplermovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savecedarcreekpark.com (koobface)"; content:"|12|savecedarcreekpark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senegalinfoservices.com (koobface)"; content:"|13|senegalinfoservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seolbong.es.kr (rfi)"; content:"|08|seolbong|02|es|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serieonline.net (rfi)"; content:"|0b|serieonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shmoo3-ad.com (koobface)"; content:"|09|shmoo3-ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sindhpk.com (koobface)"; content:"|07|sindhpk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skybluephoto.com (koobface)"; content:"|0c|skybluephoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavik11.com (zeus)"; content:"|08|slavik11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartgt.dk (koobface)"; content:"|07|smartgt|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-discounter.net (malicious)"; content:"|13|software-discounter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarealertprogram.com (malicious)"; content:"|14|softwarealertprogram|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaredirectusa.com (malicious)"; content:"|11|softwaredirectusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaremarketsite.com (malicious)"; content:"|12|softwaremarketsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somethingsunique.com (koobface)"; content:"|10|somethingsunique|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedysalesletter.com (koobface)"; content:"|11|speedysalesletter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportfinish.cn (zeus)"; content:"|0b|sportfinish|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyeraser-trial.com (malicious)"; content:"|0f|spyeraser-trial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyseraser-security.com (malicious)"; content:"|13|spyseraser-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starart.net (koobface)"; content:"|07|starart|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup static.e-lady.pl (koobface)"; content:"|06|static|06|e-lady|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup staubokultursenter.no (malicious)"; content:"|12|staubokultursenter|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stavanga.com (koobface)"; content:"|08|stavanga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stelsis.ru (rfi)"; content:"|07|stelsis|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stevenlang.net (rfi)"; content:"|0a|stevenlang|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stg-jeanmoulin.fr (koobface)"; content:"|0e|stg-jeanmoulin|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stormgroep.nl (koobface)"; content:"|0a|stormgroep|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup str8upent.com (koobface)"; content:"|09|str8upent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strandvejen-bisserup.dk (koobface)"; content:"|14|strandvejen-bisserup|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strictlydetail.co.uk (koobface)"; content:"|0e|strictlydetail|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suoie.cn (trojan)"; content:"|05|suoie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersafetysystems.com (malicious)"; content:"|12|supersafetysystems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swedpank.cn (zeus)"; content:"|08|swedpank|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenorthstarauto.com (koobface)"; content:"|10|thenorthstarauto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepinflow.com (koobface)"; content:"|0a|thepinflow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theraymondgallery.com (koobface)"; content:"|11|theraymondgallery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theusbwebsite.cn (malicious)"; content:"|0d|theusbwebsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transfer.maglite.cz (koobface)"; content:"|08|transfer|07|maglite|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup travelsigna.com (koobface)"; content:"|0b|travelsigna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trefcc.be (fastflux)"; content:"|06|trefcc|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tripgetlong.net (malicious)"; content:"|0b|tripgetlong|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubuntu123.fileave.com (rfi)"; content:"|09|ubuntu123|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ueber30.com (koobface)"; content:"|07|ueber30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unionkorneuburg.com (koobface)"; content:"|0f|unionkorneuburg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unitedsafetysupply.com (malicious)"; content:"|12|unitedsafetysupply|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup up.woyo8g.com (trojan)"; content:"|02|up|06|woyo8g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usb99.fileave.com (rfi)"; content:"|05|usb99|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usv-krakaudorf.at (koobface)"; content:"|0e|usv-krakaudorf|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v-questtx.net (koobface)"; content:"|09|v-questtx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup verde.esmasamor.com (zeus)"; content:"|05|verde|09|esmasamor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virks.co.uk (koobface)"; content:"|05|virks|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivilhavin.com (koobface)"; content:"|0a|vivilhavin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vixensoft.com.my (koobface)"; content:"|09|vixensoft|03|com|02|my"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vomlichtderberge.ch (koobface)"; content:"|10|vomlichtderberge|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchesjewelryfashion.com (malicious)"; content:"|15|watchesjewelryfashion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup water4health.com (malicious)"; content:"|0c|water4health|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyber.dk (koobface)"; content:"|05|xyber|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y83h2.com (trojan)"; content:"|05|y83h2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yogaramatgan.com (koobface)"; content:"|0c|yogaramatgan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursafetysearch.com (malicious)"; content:"|10|yoursafetysearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursafetyservices.com (malicious)"; content:"|12|yoursafetyservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourxxxsource.com (malicious)"; content:"|0d|yourxxxsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zaferburo.com.tr (koobface)"; content:"|09|zaferburo|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zamniracollection.com (koobface)"; content:"|11|zamniracollection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ze.cybercartel.name (zeus)"; content:"|02|ze|0b|cybercartel|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znakomimsa.real-host.ru (zeus)"; content:"|0a|znakomimsa|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zonetech.info (worm)"; content:"|08|zonetech|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0739ktv.cn (malicious)"; content:"|07|0739ktv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1economyguide.cn (fastflux)"; content:"|0d|1economyguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1monocline.cn (fastflux)"; content:"|0a|1monocline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1nonsensical.cn (fastflux)"; content:"|0c|1nonsensical|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1onlinestarter.cn (fastflux)"; content:"|0e|1onlinestarter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 318x.com (iframe)"; content:"|04|318x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7o8.net (harmful)"; content:"|03|7o8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actualtube.net (trojan)"; content:"|0a|actualtube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afternoontime.cn (rogue)"; content:"|0d|afternoontime|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazonhacks.cn (fastflux)"; content:"|0b|amazonhacks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antydetectivewaemergencyroom.com (rogue)"; content:"|1c|antydetectivewaemergencyroom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyoperativewaemergency.com (rogue)"; content:"|18|antyoperativewaemergency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspywaernow.com (rogue)"; content:"|0e|antyspywaernow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspywares.net (malicious)"; content:"|0c|antyspywares|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusdevice.com (rogue)"; content:"|0f|antyvirusdevice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusnow.net (malicious)"; content:"|0c|antyvirusnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusstore.net (malicious)"; content:"|0e|antyvirusstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archnadzor.ru (zbot)"; content:"|0a|archnadzor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyprotection01.com (fastflux)"; content:"|10|armyprotection01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arufeudv.cn (exploits)"; content:"|08|arufeudv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attitudecartoons.cn (rogue)"; content:"|10|attitudecartoons|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup audiodrv7.com (zbot)"; content:"|09|audiodrv7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbflashplugin.com (fastflux)"; content:"|0d|bbflashplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bicodehl.com (fastflux)"; content:"|08|bicodehl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackboyz.cn (zbot)"; content:"|09|blackboyz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bordertop.cn (trojan)"; content:"|09|bordertop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brans.pl (malicious)"; content:"|05|brans|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buycheapsoftnow.com (fraud)"; content:"|0f|buycheapsoftnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c1s.count.xj.cn (malicious)"; content:"|03|c1s|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c24845.upd.host255-255-255-0.com (trojan)"; content:"|06|c24845|03|upd|11|host255-255-255-0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centrumpluc.com.pl (malicious)"; content:"|0b|centrumpluc|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciduninstall.com (trojan)"; content:"|0c|ciduninstall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckgazibaba.org.mk (exploits)"; content:"|0a|ckgazibaba|03|org|02|mk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanvir-onmypc.com (harmfuil)"; content:"|0f|cleanvir-onmypc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contraspywaresoft.com (malicious)"; content:"|11|contraspywaresoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily2news.cn (rogue)"; content:"|0a|daily2news|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daneshvaran.com (exploiits)"; content:"|0b|daneshvaran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddkrss.com (harmfuil)"; content:"|06|ddkrss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup death5536.com (zbot)"; content:"|09|death5536|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defenderwebadvisor.com (fraud)"; content:"|12|defenderwebadvisor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delhicakesngifts.com (malicious)"; content:"|10|delhicakesngifts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalmultimediasoftware.com (fastflux)"; content:"|19|digitalmultimediasoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalprotectionservice.com (rogue)"; content:"|18|digitalprotectionservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dizymhe.cn (rogue)"; content:"|07|dizymhe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dofawi.cn (malicious)"; content:"|06|dofawi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dominchikis.com (harmfuil)"; content:"|0b|dominchikis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doquza.cn (rogue)"; content:"|06|doquza|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doqypku.cn (rogue)"; content:"|07|doqypku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.olivesoft.net (trojan)"; content:"|04|down|09|olivesoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-free-online.org (rogue)"; content:"|14|download-free-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-online-free.org (rogue)"; content:"|14|download-online-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-software-now.biz (rogue)"; content:"|15|download-software-now|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-software-now.info (rogue)"; content:"|15|download-software-now|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dozvonic.cn (trojan)"; content:"|08|dozvonic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drghzeap.cn (exploits)"; content:"|08|drghzeap|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebaytips.cn (fastflux)"; content:"|08|ebaytips|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup encybest.com (fastflux)"; content:"|08|encybest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enegoys.cn (rogue)"; content:"|07|enegoys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eneuzo.cn (rogue)"; content:"|06|eneuzo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estimategood32.cn (malicious)"; content:"|0e|estimategood32|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evolutionzone.de (zbot)"; content:"|0d|evolutionzone|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewiaguh.cn (rogue)"; content:"|07|ewiaguh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewiali.cn (rogue)"; content:"|06|ewiali|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fagylalt.extra.hu (exploits)"; content:"|08|fagylalt|05|extra|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fapzoew.cn (rogueivirus)"; content:"|07|fapzoew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashionovernet.cn (rogue)"; content:"|0e|fashionovernet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttunesclub.com (trojan)"; content:"|0d|fasttunesclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feefooof.com (zbot)"; content:"|08|feefooof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firefoxfowner.cn (fastflux)"; content:"|0d|firefoxfowner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firmware-update.cn (fastflux)"; content:"|0f|firmware-update|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fkokids.com (harmfuil)"; content:"|07|fkokids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foruminspace.com (0day)"; content:"|0c|foruminspace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxy10000.cn (zbot)"; content:"|09|foxy10000|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frags.cn (exploits)"; content:"|05|frags|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup framtr.com (fastflux)"; content:"|06|framtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyspyware.net (malicious)"; content:"|0f|freeantyspyware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freegiftslive.cn (fastflux)"; content:"|0d|freegiftslive|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freehostforyou.cn (trojan)"; content:"|0e|freehostforyou|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeinfoandpass.cn (rogue)"; content:"|0f|freeinfoandpass|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeinternetindia.com (rogue)"; content:"|11|freeinternetindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeinternetvacation.com (rogue)"; content:"|14|freeinternetvacation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frostep.com (fastflux)"; content:"|07|frostep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fundholdingllc.biz (zbot)"; content:"|0e|fundholdingllc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ganscompany.com (zbot)"; content:"|0b|ganscompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghplzwgtwe.com (exploits)"; content:"|0a|ghplzwgtwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giopnon.cn (malicious)"; content:"|07|giopnon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globaltechsoftware.com (fastflux)"; content:"|12|globaltechsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokzlykr.cn (exploits)"; content:"|08|gokzlykr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowlave.cn (malicious)"; content:"|07|gowlave|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graduatetop.cn (trojan)"; content:"|0b|graduatetop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groove-salad.cn (fastflux)"; content:"|0c|groove-salad|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumentha.com (fastflux)"; content:"|08|gumentha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haligalibumer.com (harmfuil)"; content:"|0d|haligalibumer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hallownets.cn (zbot)"; content:"|0a|hallownets|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hindger.com (fastflux)"; content:"|07|hindger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitinform.cn (malware)"; content:"|09|hitinform|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hornalfa.com (fastflux)"; content:"|08|hornalfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostingdomains.cn (rogue)"; content:"|0e|hostingdomains|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i8i1.cn (harmfuil)"; content:"|04|i8i1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ican.count.xj.cn (malicious)"; content:"|04|ican|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ideallegue662.cn (malware)"; content:"|0d|ideallegue662|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illicium.cn (malicious)"; content:"|08|illicium|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in4cs.com (rogue)"; content:"|05|in4cs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in4iv.com (rogue)"; content:"|05|in4iv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iqmediamanager.com (trojan)"; content:"|0e|iqmediamanager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istyle.in.ua (zbot)"; content:"|06|istyle|02|in|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwant2berich.cn (malware)"; content:"|0c|iwant2berich|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup izhdjcsu.cn (exploits)"; content:"|08|izhdjcsu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyqhoki.cn (rogue)"; content:"|07|jyqhoki|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyseny.cn (rogue)"; content:"|06|jyseny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klitar.cn (malicious)"; content:"|06|klitar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legroom.net (trojan)"; content:"|07|legroom|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lei.com (malicious)"; content:"|03|lei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liagand.cn (malicious)"; content:"|07|liagand|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lmageshack.biz (malicious)"; content:"|0a|lmageshack|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadmoviesoft.com (fastflux)"; content:"|0d|loadmoviesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longlivedvd.cn (rogue)"; content:"|0b|longlivedvd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loveing.count.xj.cn (malicious)"; content:"|07|loveing|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup make-statsfamily.cn (malware)"; content:"|10|make-statsfamily|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makenodifference2.cn (fastflux)"; content:"|11|makenodifference2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebytesi0.com (malicious)"; content:"|0e|malwarebytesi0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebytesy0.com (harmfuil)"; content:"|0e|malwarebytesy0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mango-culture.cn (rogue)"; content:"|0d|mango-culture|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maps-tiles.cn (fastflux)"; content:"|0a|maps-tiles|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadatastorage.net (fastflux)"; content:"|10|mediadatastorage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megafuntainment.com (harmfuil)"; content:"|0f|megafuntainment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melissamoss.net (trojan)"; content:"|0b|melissamoss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mindwork.cn (malware)"; content:"|08|mindwork|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobiec.ne (malicious)"; content:"|06|mobiec|02|ne"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilerevision.cn (fastflux)"; content:"|0e|mobilerevision|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morehod.ru (zbot)"; content:"|07|morehod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movngs.cn (zbot)"; content:"|06|movngs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaarchivedata.com (harmfuil)"; content:"|15|multimediaarchivedata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediafact.com (fastflux)"; content:"|0e|multimediafact|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediafiles.net (fastflux)"; content:"|0f|multimediafiles|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantyspyware.net (malicious)"; content:"|0d|myantyspyware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspaceimg.my.ohost.de (malicious)"; content:"|0a|myspaceimg|02|my|05|ohost|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natointros.net (zbot)"; content:"|0a|natointros|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neimantrick.com (exploits)"; content:"|0b|neimantrick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantyspyware.net (malicious)"; content:"|0e|newantyspyware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtunesclub.com (trojan)"; content:"|0c|newtunesclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nihilism.in (exploits)"; content:"|08|nihilism|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nike-petrum.cn (fastflux)"; content:"|0b|nike-petrum|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nolohing.cn (malicious)"; content:"|08|nolohing|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noloid.com (fastflux)"; content:"|06|noloid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup not.count.xj.cn (malicious)"; content:"|03|not|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup now-software-download.com (rogue)"; content:"|15|now-software-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nteeeera1.co.uk (zeus)"; content:"|09|nteeeera1|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntueeera1.eu (zeus)"; content:"|09|ntueeera1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntueeeri1.co.uk (zeus)"; content:"|09|ntueeeri1|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntueeeri1.me.uk (zeus)"; content:"|09|ntueeeri1|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntvftguu.cn (exploits)"; content:"|08|ntvftguu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-free-scanner.info (rogue)"; content:"|13|online-free-scanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-free-scanner.org (rogue)"; content:"|13|online-free-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-free.com (rogue)"; content:"|13|online-scanner-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-free.org (rogue)"; content:"|13|online-scanner-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-remover.biz (rogue)"; content:"|16|online-spyware-remover|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-remover.info (rogue)"; content:"|16|online-spyware-remover|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-remover.org (rogue)"; content:"|16|online-spyware-remover|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubeporn.biz (rogue)"; content:"|0e|onlinetubeporn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubeporn.info (rogue)"; content:"|0e|onlinetubeporn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetubeporn.org (rogue)"; content:"|0e|onlinetubeporn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ontraffic.cn (exploits)"; content:"|09|ontraffic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup operatedout.cn (trojan)"; content:"|0b|operatedout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourhomeinternet.com (rogue)"; content:"|0f|ourhomeinternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ovideo.us (trojan)"; content:"|06|ovideo|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup para-para.cn (fastflux)"; content:"|09|para-para|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprivacycleaner.com (harmfuil)"; content:"|10|pcprivacycleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pekincenter.cn (trojan)"; content:"|0b|pekincenter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectofan.cn (malware)"; content:"|0b|perfectofan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pohsoft.in (harmfuil)"; content:"|07|pohsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-online-tube.biz (rogue)"; content:"|10|porn-online-tube|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-online-tube.info (rogue)"; content:"|10|porn-online-tube|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-online-tube.org (rogue)"; content:"|10|porn-online-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powercapacity.cn (rogue)"; content:"|0d|powercapacity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerfulvirusremover2008.com (harmfuil)"; content:"|18|powerfulvirusremover2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prefect-defencem.com (fastflux)"; content:"|10|prefect-defencem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prefect-defencey.com (fastflux)"; content:"|10|prefect-defencey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup presidentvictory.cn (rogue)"; content:"|10|presidentvictory|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privasaz002.notlong.com (rogue)"; content:"|0b|privasaz002|07|notlong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pullingout.org (trojan)"; content:"|0a|pullingout|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queenofneworlean.cn (rogue)"; content:"|10|queenofneworlean|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtubeworld.com (trojan)"; content:"|0d|realtubeworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removeallaswarea.cn (fastflux)"; content:"|10|removeallaswarea|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roomafterhide.net (malicious)"; content:"|0d|roomafterhide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s1.lolblog.cn (malicious)"; content:"|02|s1|07|lolblog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s15.ucoz.de (exploiits)"; content:"|03|s15|04|ucoz|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samarkets.com (exploiits)"; content:"|09|samarkets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scancopyservice.com (rogue)"; content:"|0f|scancopyservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-download-free.biz (rogue)"; content:"|15|scanner-download-free|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-download-free.info (rogue)"; content:"|15|scanner-download-free|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-download-free.org (rogue)"; content:"|15|scanner-download-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-free-online.info (rogue)"; content:"|13|scanner-free-online|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-free-online.net (rogue)"; content:"|13|scanner-free-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-free-online.org (rogue)"; content:"|13|scanner-free-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretalltrue2.cn (fastflux)"; content:"|0e|secretalltrue2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secrettales.cn (rogue)"; content:"|0b|secrettales|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.33drugs.com (fraud)"; content:"|06|secure|07|33drugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servicesocks5.cn (zbot)"; content:"|0d|servicesocks5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servscanner03.com (fastflux)"; content:"|0d|servscanner03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servscanner07.com (fastflux)"; content:"|0d|servscanner07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setmoviesoft.net (fastflux)"; content:"|0c|setmoviesoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-online-tube.biz (rogue)"; content:"|0f|sex-online-tube|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-online-tube.info (rogue)"; content:"|0f|sex-online-tube|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-online-tube.org (rogue)"; content:"|0f|sex-online-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-tube-online.org (rogue)"; content:"|0f|sex-tube-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoreculturalcentre.org (harmfuil)"; content:"|13|shoreculturalcentre|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirius-debil.su (harmfuil)"; content:"|0c|sirius-debil|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sm44.cn (exploits)"; content:"|04|sm44|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socks5servic.cn (zbot)"; content:"|0c|socks5servic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-multimedia.com (fastflux)"; content:"|0f|soft-multimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-scaner-online.net (harmfuil)"; content:"|16|software-scaner-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solis.in (fastflux)"; content:"|05|solis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-online-remover.biz (rogue)"; content:"|16|spyware-online-remover|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-online-remover.info (rogue)"; content:"|16|spyware-online-remover|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-online-remover.org (rogue)"; content:"|16|spyware-online-remover|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-removeb.com (malicious)"; content:"|0f|spyware-removeb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stephens-laughlin.com (trojan)"; content:"|11|stephens-laughlin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stillsnapshots.cn (rogue)"; content:"|0e|stillsnapshots|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stomaid.ru (harmfuil)"; content:"|07|stomaid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop.count.xj.cn (malicious)"; content:"|04|stop|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super0multimedia.com (fastflux)"; content:"|10|super0multimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super7decision.cn (harmfuil)"; content:"|0e|super7decision|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superbillingsystem.com (harmfuil)"; content:"|12|superbillingsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superprotectionact.com (rogue)"; content:"|12|superprotectionact|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysadscanner.com (malicious)"; content:"|0c|sysadscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantyvirus.net (malicious)"; content:"|0c|theantyvirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theessentialresource.com (rogue)"; content:"|14|theessentialresource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestabilitycontrol.com (rogue)"; content:"|13|thestabilitycontrol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestopbadware.com (malicious)"; content:"|0e|thestopbadware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theyaredead.net (harmfuil)"; content:"|0b|theyaredead|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titlebonus.cn (fastflux)"; content:"|0a|titlebonus|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tonugood.cn (harmfuil)"; content:"|08|tonugood|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradevintage.org (harmfuil)"; content:"|0c|tradevintage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube-porn-today.com (rogue)"; content:"|0f|tube-porn-today|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube-sex-online.net (rogue)"; content:"|0f|tube-sex-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube-sex-online.org (rogue)"; content:"|0f|tube-sex-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornonline.biz (rogue)"; content:"|0e|tubepornonline|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornonline.info (rogue)"; content:"|0e|tubepornonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornonline.org (rogue)"; content:"|0e|tubepornonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uktimes.cn (rogue)"; content:"|07|uktimes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd.netbios-wait.com (trojan)"; content:"|03|upd|0c|netbios-wait|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updaterg.org (harmfuil)"; content:"|08|updaterg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uprightfireprotection.com (rogue)"; content:"|15|uprightfireprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vista.lk (harmfuil)"; content:"|05|vista|02|lk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vobhod.ru (exploits)"; content:"|06|vobhod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup washedout.cn (trojan)"; content:"|09|washedout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wheel-visualizer.com (harmfuil)"; content:"|10|wheel-visualizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdefencey.cn (fastflux)"; content:"|0f|windowsdefencey|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winproantivirus99.com (malicious)"; content:"|11|winproantivirus99|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worlddomainoutlet.com (zbot)"; content:"|11|worlddomainoutlet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsearchassistant.com (malicious)"; content:"|14|worldsearchassistant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x000x.cn (exploits)"; content:"|05|x000x|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x010x.cn (harmfuil)"; content:"|05|x010x|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x2827.nb.host192-168-1-2.com (trojan)"; content:"|05|x2827|02|nb|0f|host192-168-1-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y7099.nb.host-domain-lookup.com (trojan)"; content:"|05|y7099|02|nb|12|host-domain-lookup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesandns.cn (zbot)"; content:"|08|yesandns|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you.count.xj.cn (malicious)"; content:"|03|you|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourclicker.cn (harmfuil)"; content:"|0b|yourclicker|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourlegalprotection.com (rogue)"; content:"|13|yourlegalprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourstabilitystudy.com (rogue)"; content:"|12|yourstabilitystudy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtireprotection.com (rogue)"; content:"|12|yourtireprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zimmermannindustries.com (fastflux)"; content:"|14|zimmermannindustries|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup znarmarios.com.br (malicious)"; content:"|0a|znarmarios|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 26044.com (malicious)"; content:"|05|26044|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3310.net.cn (malicious)"; content:"|04|3310|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 888playeuro.net (malicious)"; content:"|0b|888playeuro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aduka.com (malware)"; content:"|05|aduka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allowjobs.cn (malicious)"; content:"|09|allowjobs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antibalk.cn (malicious)"; content:"|08|antibalk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispylista.com (malicious)"; content:"|0c|antispylista|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atatatata.org (malware)"; content:"|09|atatatata|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcplcwytwe.com (harmful)"; content:"|0a|bcplcwytwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bins.lop.com (malicious)"; content:"|04|bins|03|lop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogcasino.org (malicious)"; content:"|0a|blogcasino|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonuseurodice.net (malicious)"; content:"|0d|bonuseurodice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonusvegasgame.net (malicious)"; content:"|0e|bonusvegasgame|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brendbar.cn (malicious)"; content:"|08|brendbar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsinginternetcafe.com (malicious)"; content:"|14|browsinginternetcafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsingthrough.com (malicious)"; content:"|0f|browsingthrough|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cartbank.cn (malicious)"; content:"|08|cartbank|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinoroyalopen.net (malicious)"; content:"|0f|casinoroyalopen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciscofans.cn (malicious)"; content:"|09|ciscofans|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup controlmovieutilites.com (malicious)"; content:"|14|controlmovieutilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countymove.com (malicious)"; content:"|0a|countymove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cws.crowebserver.com (malicious)"; content:"|03|cws|0c|crowebserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daytrnds.cn (malware)"; content:"|08|daytrnds|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dc-market.ru (malicious)"; content:"|09|dc-market|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendandsecure.cn (malicious)"; content:"|0f|defendandsecure|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup developmentene.com (malicious)"; content:"|0e|developmentene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dicebonuseuro.net (malicious)"; content:"|0d|dicebonuseuro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diceeurobonus.net (malicious)"; content:"|0d|diceeurobonus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dimage.com (malware)"; content:"|06|dimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electionprogress.com (malicious)"; content:"|10|electionprogress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elsemon.cn (malicious)"; content:"|07|elsemon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileaddiction.com (malicious)"; content:"|0d|fileaddiction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flxvircorp.cn (malicious)"; content:"|0a|flxvircorp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedatatransfer.com (malicious)"; content:"|10|freedatatransfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabtibbgtwe.com (torpig)"; content:"|0b|gabtibbgtwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gainvictory.cn (malicious)"; content:"|0b|gainvictory|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefjcrpgtwe.com (torpig)"; content:"|0b|gefjcrpgtwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getdasoft.cn (malicious)"; content:"|09|getdasoft|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getfreemediaplugin.com (malicious)"; content:"|12|getfreemediaplugin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatessential.com (malicious)"; content:"|0e|greatessential|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatesttubes.net (malicious)"; content:"|0d|greatesttubes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatscanonline.com (malicious)"; content:"|0f|greatscanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackandsmack.cn (malicious)"; content:"|0c|hackandsmack|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hat99.biz (malware)"; content:"|05|hat99|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiqxjxjtwe.com (harmful)"; content:"|0a|hiqxjxjtwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-table.cn (malicious)"; content:"|09|hot-table|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housestyle2.cn (malicious)"; content:"|0b|housestyle2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsbc-trial.cn (malicious)"; content:"|0a|hsbc-trial|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsbc-trial.net (malicious)"; content:"|0a|hsbc-trial|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idreadweb.com (malicious)"; content:"|09|idreadweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagearchive.im.ohost.de (malware)"; content:"|0c|imagearchive|02|im|05|ohost|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indigosecurityshop.com (malicious)"; content:"|12|indigosecurityshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inttools.ru (malicious)"; content:"|08|inttools|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jallabyah.com (malicious)"; content:"|09|jallabyah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keepmeupdated.cn (malicious)"; content:"|0d|keepmeupdated|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingcazinospin.net (malicious)"; content:"|0e|kingcazinospin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingspincazino.net (malicious)"; content:"|0e|kingspincazino|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacylucy.com (malicious)"; content:"|08|lacylucy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livepcguard.com (malicious)"; content:"|0b|livepcguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadssell.com (malicious)"; content:"|09|loadssell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luminou7.free.fr (malware)"; content:"|08|luminou7|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madalwayz.cn (malicious)"; content:"|09|madalwayz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makesafeyourpc.net (malicious)"; content:"|0e|makesafeyourpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maqcu.net (malware)"; content:"|05|maqcu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mattoomatuyz.info (malicious)"; content:"|0c|mattoomatuyz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxdomzhit.com (malicious)"; content:"|0a|maxdomzhit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mebel-garant.ru (malicious)"; content:"|0c|mebel-garant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediapluginsite.com (malicious)"; content:"|0f|mediapluginsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup messmate2.cn (malicious)"; content:"|09|messmate2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metabb-new.com (malicious)"; content:"|0a|metabb-new|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftoutlaw.cn (malicious)"; content:"|0f|microsoftoutlaw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momo26.no-ip.biz (malicious)"; content:"|06|momo26|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movereports.com (malicious)"; content:"|0b|movereports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mstbannerunz.info (malicious)"; content:"|0c|mstbannerunz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediafigure.com (malicious)"; content:"|10|multimediafigure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediatally.com (malicious)"; content:"|0f|multimediatally|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkstabilityinc.com (malicious)"; content:"|13|networkstabilityinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-age-music.cn (malicious)"; content:"|0d|new-age-music|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsplaza.net (malware)"; content:"|09|newsplaza|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nontipago.it (malicious)"; content:"|09|nontipago|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opencasinoroyal.net (malicious)"; content:"|0f|opencasinoroyal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openroyalcasino.net (malicious)"; content:"|0f|openroyalcasino|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup organicnecessary.com (malicious)"; content:"|10|organicnecessary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paramauntpicturec.cn (malicious)"; content:"|11|paramauntpicturec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-computerload.com (malicious)"; content:"|0f|pc-computerload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcliveguard.com (malicious)"; content:"|0b|pcliveguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picshomer.cn (malicious)"; content:"|09|picshomer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play888euro.net (malicious)"; content:"|0b|play888euro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playeuro888.net (malicious)"; content:"|0b|playeuro888|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pocosecuritymall.com (malicious)"; content:"|10|pocosecuritymall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poezd-v-ad.eu (malware)"; content:"|0a|poezd-v-ad|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powermediautilites.com (malicious)"; content:"|12|powermediautilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prodefence1.cn (malicious)"; content:"|0b|prodefence1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressmovement.com (malicious)"; content:"|10|progressmovement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projectbasedbrowsing.com (malicious)"; content:"|14|projectbasedbrowsing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualityupload.com (malicious)"; content:"|0d|qualityupload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readheadsweb.com (malicious)"; content:"|0c|readheadsweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readmailonline.com (malicious)"; content:"|0e|readmailonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readpressonline.com (malicious)"; content:"|0f|readpressonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readriteonline.com (malicious)"; content:"|0e|readriteonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readwebworld.com (malicious)"; content:"|0c|readwebworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recentshopping.cn (malicious)"; content:"|0e|recentshopping|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remote-logger.com (malicious)"; content:"|0d|remote-logger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renlan.com (malicious)"; content:"|06|renlan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalsecureb1.com (malicious)"; content:"|0d|royalsecureb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruslan777.com (malicious)"; content:"|09|ruslan777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-infoa.com (malicious)"; content:"|0d|scanner-infoa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonlineguide.com (malicious)"; content:"|0f|scanonlineguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonlinepharmacy.com (malicious)"; content:"|12|scanonlinepharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanonlinepoker.com (malicious)"; content:"|0f|scanonlinepoker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdfnucleartqg.info (malware)"; content:"|0d|sdfnucleartqg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slip-stream.cn (malicious)"; content:"|0b|slip-stream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-shopper.com (malicious)"; content:"|10|software-shopper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacetrafficsafety.com (malicious)"; content:"|12|spacetrafficsafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spinkingcazino.net (malicious)"; content:"|0e|spinkingcazino|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starscasinoweb.net (malicious)"; content:"|0e|starscasinoweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thedynamicstability.com (malicious)"; content:"|13|thedynamicstability|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themultimediaplayer.com (malicious)"; content:"|13|themultimediaplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theprogressclub.com (malicious)"; content:"|0f|theprogressclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestabilityfund.com (malicious)"; content:"|10|thestabilityfund|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-defencey.com (malicious)"; content:"|0c|top-defencey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topdefence2.com (malicious)"; content:"|0b|topdefence2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topmusicstore.cn (malicious)"; content:"|0d|topmusicstore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffb.be (malicious)"; content:"|06|treffb|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffd.be (malicious)"; content:"|06|treffd|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffg.be (malicious)"; content:"|06|treffg|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffq.be (malicious)"; content:"|06|treffq|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffr.be (malicious)"; content:"|06|treffr|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffw.be (malicious)"; content:"|06|treffw|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treffx.be (malicious)"; content:"|06|treffx|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustscan-onmyzone.com (malicious)"; content:"|12|trustscan-onmyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vegasbonusgame.net (malicious)"; content:"|0e|vegasbonusgame|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vegasgamebonus.net (malicious)"; content:"|0e|vegasgamebonus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmester.net (malware)"; content:"|09|webmester|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdefencer.cn (malicious)"; content:"|0f|windowsdefencer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-ebooks.net (malicious)"; content:"|0b|your-ebooks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yournecessary.com (malicious)"; content:"|0d|yournecessary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 02def53.netsolhost.com (koobface)"; content:"|07|02def53|0a|netsolhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2live.be (koobface)"; content:"|05|2live|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3chailave.cn (malware)"; content:"|09|3chailave|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 576966.283168261.cn (trojan)"; content:"|06|576966|09|283168261|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaskereia-online.de (koobface)"; content:"|10|aaskereia-online|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abbottpainting.com (koobface)"; content:"|0e|abbottpainting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abstateverytime.com (zeus)"; content:"|0f|abstateverytime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acbid.org (koobface)"; content:"|05|acbid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup achieve21-121.cn (trojan)"; content:"|0d|achieve21-121|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acid4roll.info (zeus)"; content:"|09|acid4roll|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acko.gympl.com (koobface)"; content:"|04|acko|05|gympl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin.bbexe.cn (trojan)"; content:"|05|admin|05|bbexe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agrico.sk (koobface)"; content:"|06|agrico|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexandermolloy.blogspot.com (koobface)"; content:"|0f|alexandermolloy|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexandertech.co.il (koobface)"; content:"|0d|alexandertech|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinonesecurity0.com (rogue)"; content:"|11|allinonesecurity0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almetal.de (koobface)"; content:"|07|almetal|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amicableresolutionsintl.com (koobface)"; content:"|17|amicableresolutionsintl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup an-ty-flu-service.com (rogue)"; content:"|11|an-ty-flu-service|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annunciationgsk8.com (koobface)"; content:"|10|annunciationgsk8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antikeep.com (rogue)"; content:"|08|antikeep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyk.com.au (koobface)"; content:"|05|antyk|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusaccessory.net (attack_site)"; content:"|12|antyvirusaccessory|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anyhimi.cn (zeus)"; content:"|07|anyhimi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aparthotel-bellehelene.com (koobface)"; content:"|16|aparthotel-bellehelene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artguide.co.il (koobface)"; content:"|08|artguide|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artschwartz.com (koobface)"; content:"|0b|artschwartz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axe0911.freesitespace.net (koobface)"; content:"|07|axe0911|0d|freesitespace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babyprintart.com (koobface)"; content:"|0c|babyprintart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup back-n-line.com (koobface)"; content:"|0b|back-n-line|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badaosoft.net (trojan)"; content:"|09|badaosoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bajwa786inc.com (koobface)"; content:"|0b|bajwa786inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbs.fy80.cn (trojan)"; content:"|03|bbs|04|fy80|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautiteen.hostmaniacs.com (koobface)"; content:"|0a|beautiteen|0b|hostmaniacs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scan.biz (rogue)"; content:"|09|best-scan|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecurityutility.net (rogue)"; content:"|13|bestsecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezhyn.com (zeus)"; content:"|06|bezhyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigmart.com.np (koobface)"; content:"|07|bigmart|03|com|02|np"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitterlicks.com (koobface)"; content:"|0b|bitterlicks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blainblainprinciotta.blogspot.com (koobface)"; content:"|14|blainblainprinciotta|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluesecurityutility.net (rogue)"; content:"|13|bluesecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boatnews.eu (koobface)"; content:"|08|boatnews|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobband.net (koobface)"; content:"|07|bobband|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boerne.nordherde.de (koobface)"; content:"|06|boerne|09|nordherde|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bondgrenmerrill.blogspot.com (koobface)"; content:"|0f|bondgrenmerrill|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brauhaus-vetter.de (koobface)"; content:"|0f|brauhaus-vetter|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burgesshillfairtradefestival.org (zeus)"; content:"|1c|burgesshillfairtradefestival|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businesstech.fr (koobface)"; content:"|0c|businesstech|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butikk-senter.no (koobface)"; content:"|0d|butikk-senter|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdgi-inc.com (koobface)"; content:"|08|cdgi-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celatriantafillos.blogspot.com (koobface)"; content:"|11|celatriantafillos|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chateaudecoisse.com (koobface)"; content:"|0f|chateaudecoisse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapitaly.it (koobface)"; content:"|0a|cheapitaly|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chevicheviaskins.blogspot.com (koobface)"; content:"|10|chevicheviaskins|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chris25project.cn (zeus)"; content:"|0e|chris25project|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cird.ru (zeus)"; content:"|04|cird|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clanscissors.com (koobface)"; content:"|0c|clanscissors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clients.rootsecure.org (zeus)"; content:"|07|clients|0a|rootsecure|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cmpmiami.com (koobface)"; content:"|08|cmpmiami|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cold-random312.cn (exploit)"; content:"|0e|cold-random312|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computer-antivirusb1.cn (rogue)"; content:"|14|computer-antivirusb1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corsaire.ch (koobface)"; content:"|08|corsaire|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmeticspermanent.net (koobface)"; content:"|12|cosmeticspermanent|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup createfinancialstability.com (rogue)"; content:"|18|createfinancialstability|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creative71.eu (trojan)"; content:"|0a|creative71|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystaknuf.blogspot.com (koobface)"; content:"|0a|crystaknuf|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctsrmspos.com (koobface)"; content:"|09|ctsrmspos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup customsoftwareupdate.cn (malware)"; content:"|14|customsoftwareupdate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cwbnewsonline.cn (exploit)"; content:"|0d|cwbnewsonline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darkshop.co.il (koobface)"; content:"|08|darkshop|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dddcc.com (koobface)"; content:"|05|dddcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deca200.net (koobface)"; content:"|07|deca200|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decomanufacturing.net (koobface)"; content:"|11|decomanufacturing|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defenderav.com (rogue)"; content:"|0a|defenderav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondsbydavids.com (koobface)"; content:"|10|diamondsbydavids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dickdickmaigue.blogspot.com (koobface)"; content:"|0e|dickdickmaigue|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dinar-cs.real-host.ru (zeus)"; content:"|08|dinar-cs|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directmegastock.info (zeus)"; content:"|0f|directmegastock|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverwellnessweekend.com (koobface)"; content:"|17|discoverwellnessweekend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup distribuidoraderetentores.com.br (trojan)"; content:"|19|distribuidoraderetentores|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolcegabbana.djbormand.cn (exploit)"; content:"|0c|dolcegabbana|09|djbormand|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doli1.co.il (koobface)"; content:"|05|doli1|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dr3yfus.uni.cc (zeus)"; content:"|07|dr3yfus|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drygy.mooo.com (zeus)"; content:"|05|drygy|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dugunhikayemiz.com (koobface)"; content:"|0e|dugunhikayemiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup economy.rags.ru (koobface)"; content:"|07|economy|04|rags|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup el-buy.no (koobface)"; content:"|06|el-buy|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elkhamlichiwortham.blogspot.com (koobface)"; content:"|12|elkhamlichiwortham|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emolloy.com (koobface)"; content:"|07|emolloy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enardemelynn.blogspot.com (koobface)"; content:"|0c|enardemelynn|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eom.it (koobface)"; content:"|03|eom|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eriade.com (koobface)"; content:"|06|eriade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erlsoft.in (rogue)"; content:"|07|erlsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eshreya.com (koobface)"; content:"|07|eshreya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estimate-good32-021.cn (exploit)"; content:"|13|estimate-good32-021|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estimate-good32021.cn (exploit)"; content:"|12|estimate-good32021|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estimategood32-021.cn (exploit)"; content:"|12|estimategood32-021|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estimategood32021.cn (exploit)"; content:"|11|estimategood32021|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewezyod.cn (rogue)"; content:"|07|ewezyod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyes.by (trojan)"; content:"|04|eyes|02|by"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup familyhomes4you.com (koobface)"; content:"|0f|familyhomes4you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fampir.cn (zeus)"; content:"|06|fampir|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farmsecurityutility.net (rogue)"; content:"|13|farmsecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farukfarukpavlica.blogspot.com (koobface)"; content:"|11|farukfarukpavlica|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-sys-downloads.info (trojan)"; content:"|12|fast-sys-downloads|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiberopticinstrument.com (koobface)"; content:"|14|fiberopticinstrument|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flinchumjettejette.blogspot.com (koobface)"; content:"|12|flinchumjettejette|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fosbergchuwei.blogspot.com (koobface)"; content:"|0d|fosbergchuwei|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freesecurityutility.net (rogue)"; content:"|13|freesecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freresbethlehem.org (koobface)"; content:"|0f|freresbethlehem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsubasket.com (koobface)"; content:"|09|fsubasket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gate234.cn (zeus)"; content:"|07|gate234|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-this-video.com (backdoor)"; content:"|0e|get-this-video|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getshealth11.cn (exploit)"; content:"|0c|getshealth11|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getusersvideo.com (backdoor)"; content:"|0d|getusersvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghregypt.com (koobface)"; content:"|08|ghregypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glyk.ch (koobface)"; content:"|04|glyk|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenhillsroseville.com (koobface)"; content:"|14|goldenhillsroseville|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldhavenlibrary.netfirms.com (koobface)"; content:"|10|goldhavenlibrary|08|netfirms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldlave.cn (exploit)"; content:"|08|goldlave|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gordimdemel.xpg.com.br (trojan)"; content:"|0b|gordimdemel|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowebsolutions.ca (koobface)"; content:"|0e|gowebsolutions|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gratisprogram.no (koobface)"; content:"|0d|gratisprogram|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwypg.co.uk (koobface)"; content:"|05|gwypg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h0stels.cn (c&c)"; content:"|07|h0stels|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackershell.org (zeus)"; content:"|0b|hackershell|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hemlytool.com (koobface)"; content:"|09|hemlytool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiceortalortal.blogspot.com (koobface)"; content:"|0e|hiceortalortal|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup himalonline.com (koobface)"; content:"|0b|himalonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homecell368.co.za (koobface)"; content:"|0b|homecell368|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotelthier.at (koobface)"; content:"|0a|hotelthier|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotflashmovies.cn (zeus)"; content:"|0e|hotflashmovies|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icelkumbasar.com (koobface)"; content:"|0c|icelkumbasar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ies.bbexe.cn (trojan)"; content:"|03|ies|05|bbexe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iksadh.co.im (zeus)"; content:"|06|iksadh|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illuminators.com.au (koobface)"; content:"|0c|illuminators|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup india-tours.cn (rogue)"; content:"|0b|india-tours|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instrumentenschmiede.at (koobface)"; content:"|14|instrumentenschmiede|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irsanirsanfelber.blogspot.com (koobface)"; content:"|10|irsanirsanfelber|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup josecure.com (koobface)"; content:"|08|josecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jost.cc (koobface)"; content:"|04|jost|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jotya.com (koobface)"; content:"|05|jotya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jugendfeuerwehr-zermatt.ch (koobface)"; content:"|17|jugendfeuerwehr-zermatt|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin1.cn (exploit)"; content:"|07|justin1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin10.cn (exploit)"; content:"|08|justin10|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin11.cn (exploit)"; content:"|08|justin11|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin12.cn (exploit)"; content:"|08|justin12|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin13.cn (exploit)"; content:"|08|justin13|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin14.cn (exploit)"; content:"|08|justin14|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin15.cn (exploit)"; content:"|08|justin15|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin2.cn (exploit)"; content:"|07|justin2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin4.cn (exploit)"; content:"|07|justin4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justin5.cn (exploit)"; content:"|07|justin5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kathmandumutual.com (koobface)"; content:"|0f|kathmandumutual|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup katrienpillier.blogspot.com (koobface)"; content:"|0e|katrienpillier|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kibbeykiernan.blogspot.com (koobface)"; content:"|0d|kibbeykiernan|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kibs.co.za (koobface)"; content:"|04|kibs|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kick-assworkouts.co.uk (koobface)"; content:"|10|kick-assworkouts|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klimskoe.cn (zeus)"; content:"|08|klimskoe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klopfstein.info (koobface)"; content:"|0a|klopfstein|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krejcovi.com (koobface)"; content:"|08|krejcovi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krissondrabattaile.blogspot.com (koobface)"; content:"|12|krissondrabattaile|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwangkwangcarlstead-chavira.blogspot.com (koobface)"; content:"|1b|kwangkwangcarlstead-chavira|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lao7777.com (trojan)"; content:"|07|lao7777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup larosmontenegro.com (rogue)"; content:"|0f|larosmontenegro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letarebeca.150m.com (rogue)"; content:"|0a|letarebeca|04|150m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup louwiedorthea.blogspot.com (koobface)"; content:"|0d|louwiedorthea|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lowrysigns.com (koobface)"; content:"|0a|lowrysigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrearn.com (zeus)"; content:"|06|lrearn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lurettarubalcaba.blogspot.com (koobface)"; content:"|10|lurettarubalcaba|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxproproducts.com (koobface)"; content:"|0e|luxproproducts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwddos.cn (trojan)"; content:"|06|lwddos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madcmx.mx (zeus)"; content:"|06|madcmx|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-scaner.info (rogue)"; content:"|0e|malware-scaner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mannardiocese.com (koobface)"; content:"|0d|mannardiocese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcilmickymicky.blogspot.com (koobface)"; content:"|10|marcilmickymicky|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maximilian-wachmann.at (koobface)"; content:"|13|maximilian-wachmann|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcduffyanabela.blogspot.com (koobface)"; content:"|0e|mcduffyanabela|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medomedogerberon.blogspot.com (koobface)"; content:"|10|medomedogerberon|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mergex.netfirms.com (koobface)"; content:"|06|mergex|08|netfirms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mgmcr.net (koobface)"; content:"|05|mgmcr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milantrezur.com (koobface)"; content:"|0b|milantrezur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miliabiniam.blogspot.com (koobface)"; content:"|0b|miliabiniam|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mir2games.cn (trojan)"; content:"|09|mir2games|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mm2dc.com (koobface)"; content:"|05|mm2dc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moi-meme.com.hk (koobface)"; content:"|08|moi-meme|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneyversionpro.com (zeus)"; content:"|0f|moneyversionpro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moriermubeen.blogspot.com (koobface)"; content:"|0c|moriermubeen|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msprotectionscan0.com (rogue)"; content:"|11|msprotectionscan0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtcpowersystem.com (koobface)"; content:"|0e|mtcpowersystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwiapps.co.cc (koobface)"; content:"|07|mwiapps|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfurnitureshop.freehostia.com (zeus)"; content:"|0f|myfurnitureshop|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymobiguard.com (koobface)"; content:"|0b|mymobiguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynewworldorder.cn (malware)"; content:"|0f|mynewworldorder|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywantsapp.iwants.com (koobface)"; content:"|0a|mywantsapp|06|iwants|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nallelyshortland.blogspot.com (koobface)"; content:"|10|nallelyshortland|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazmins.com (koobface)"; content:"|07|nazmins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neisercandala.blogspot.com (koobface)"; content:"|0d|neisercandala|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nepaaudubonsociety.org (koobface)"; content:"|12|nepaaudubonsociety|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-proper.cn (rogue)"; content:"|0a|new-proper|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new10mum.myftp.org (trojan)"; content:"|08|new10mum|05|myftp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neworld.tohosting.net (trojan)"; content:"|07|neworld|09|tohosting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newporkeronline.cn (exploit)"; content:"|0f|newporkeronline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsecurityutility.net (rogue)"; content:"|12|newsecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nippontrading.se (koobface)"; content:"|0d|nippontrading|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nntpabusenm.tripod.com (zeus)"; content:"|0b|nntpabusenm|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntwira.com (koobface)"; content:"|06|ntwira|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odgaardleruelerue.blogspot.com (koobface)"; content:"|11|odgaardleruelerue|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onderwijsnet.be (koobface)"; content:"|0c|onderwijsnet|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optimumorg.com (koobface)"; content:"|0a|optimumorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outofcontrolproducts.com (koobface)"; content:"|14|outofcontrolproducts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pandelidismellonie.blogspot.com (koobface)"; content:"|12|pandelidismellonie|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parachabethbeth.blogspot.com (koobface)"; content:"|0f|parachabethbeth|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanner.info (rogue)"; content:"|0a|pc-scanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanner.us (rogue)"; content:"|0a|pc-scanner|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacy-protect.cn (fraud)"; content:"|0f|privacy-protect|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prointernetdefence2.com (rogue)"; content:"|13|prointernetdefence2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokstadkeaton.blogspot.com (koobface)"; content:"|0d|rokstadkeaton|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royaldefensescan.com (rogue)"; content:"|10|royaldefensescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secsoft-estore.com (rogue)"; content:"|0e|secsoft-estore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-estore.com (rogue)"; content:"|0f|security-estore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityexternaltools.ne (rogue)"; content:"|15|securityexternaltools|02|ne"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityintelligencetools.net (rogue)"; content:"|19|securityintelligencetools|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsediting.net (rogue)"; content:"|14|securitytoolsediting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolslisted.net (rogue)"; content:"|13|securitytoolslisted|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsprior.net (rogue)"; content:"|12|securitytoolsprior|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolsuser.net (rogue)"; content:"|11|securitytoolsuser|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitybelt.net (rogue)"; content:"|13|securityutilitybelt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilityblog.net (rogue)"; content:"|13|securityutilityblog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitydisc.net (rogue)"; content:"|13|securityutilitydisc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilityonline.net (rogue)"; content:"|15|securityutilityonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitys.net (rogue)"; content:"|10|securityutilitys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilityshop.net (rogue)"; content:"|13|securityutilityshop|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitystore.net (rogue)"; content:"|14|securityutilitystore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitytoday.net (rogue)"; content:"|14|securityutilitytoday|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityutilitytool.net (rogue)"; content:"|13|securityutilitytool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 11f1iili.com (phishing)"; content:"|08|11f1iili|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1analytics.ws (exploit)"; content:"|0a|1analytics|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigroutfe.com (harmful)"; content:"|09|bigroutfe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easytabletennis.ru (threat)"; content:"|0f|easytabletennis|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ergemhzx.cn (trojan)"; content:"|08|ergemhzx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghdinc.org (malware)"; content:"|06|ghdinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pedjulino.com (zeus)"; content:"|09|pedjulino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petervink.com (koobface)"; content:"|09|petervink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfsystems.com.au (koobface)"; content:"|09|pfsystems|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup philbricktsachtsach.blogspot.com (koobface)"; content:"|13|philbricktsachtsach|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phiphismaluch.blogspot.com (koobface)"; content:"|0d|phiphismaluch|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoscansecurity.cn (rogue)"; content:"|11|photoscansecurity|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pirandelloaspect.com (koobface)"; content:"|10|pirandelloaspect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pixels-prod.com (koobface)"; content:"|0b|pixels-prod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popupserf.cn (emo)"; content:"|09|popupserf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumbullets.cn (botnet)"; content:"|0e|premiumbullets|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preventiondenver.com (koobface)"; content:"|10|preventiondenver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pridesoccer.com (koobface)"; content:"|0b|pridesoccer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priscillapresley.com (malware)"; content:"|10|priscillapresley|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup programmerpro.info (koobface)"; content:"|0d|programmerpro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promservice.sky.ru (koobface)"; content:"|0b|promservice|03|sky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxcallcentercareersx.com (zeus)"; content:"|14|pxcallcentercareersx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsharp.kilu.de (koobface)"; content:"|06|qsharp|04|kilu|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reflexcontracts.co.uk (koobface)"; content:"|0f|reflexcontracts|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reminisceproductions.com (koobface)"; content:"|14|reminisceproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restaurantemiguelcerdan.com (zeus)"; content:"|17|restaurantemiguelcerdan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retardedcutlery.com (koobface)"; content:"|0f|retardedcutlery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rettwest.no (koobface)"; content:"|08|rettwest|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rightdecisionhere2.cn (exploit)"; content:"|12|rightdecisionhere2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalprotectionscan.com (rogue)"; content:"|13|royalprotectionscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s2web.sites.uol.com.br (trojan)"; content:"|05|s2web|05|sites|03|uol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s90820691.onlinehome.us (koobface)"; content:"|09|s90820691|0a|onlinehome|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saberg.biz (zeus)"; content:"|06|saberg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safehostingsolutions.com (trojan)"; content:"|14|safehostingsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samandgostar.com (exploit)"; content:"|0c|samandgostar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samuraineverdiee.com (malware)"; content:"|10|samuraineverdiee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saratogasteakhouse.com (koobface)"; content:"|12|saratogasteakhouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sauipeswimwear.com (koobface)"; content:"|0e|sauipeswimwear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sblocco.net (zeus)"; content:"|07|sblocco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scdjnlsdncs.com (zeus)"; content:"|0b|scdjnlsdncs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schoolaz.com (koobface)"; content:"|08|schoolaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdfjnjsdn.com (zeus)"; content:"|09|sdfjnjsdn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seassociation.sg (koobface)"; content:"|0d|seassociation|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siadesign.net (koobface)"; content:"|09|siadesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallbusinesssecretstomarketing.com (koobface)"; content:"|1f|smallbusinesssecretstomarketing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartmechanic.net (rogue)"; content:"|0d|smartmechanic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smutbeach.com (trojan)"; content:"|09|smutbeach|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sng-soft.com (zeus)"; content:"|08|sng-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software1update.info (malware)"; content:"|0f|software1update|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spengler-dachdecker.at (koobface)"; content:"|13|spengler-dachdecker|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splash-kids.com (koobface)"; content:"|0b|splash-kids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssequipmenthire.com.au (koobface)"; content:"|0f|ssequipmenthire|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sstiger.customer.netspace.net.au (koobface)"; content:"|07|sstiger|08|customer|08|netspace|03|net|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starbrands-ltd.com (koobface)"; content:"|0e|starbrands-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starturl.com (rogue)"; content:"|08|starturl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-smoking-today.com (koobface)"; content:"|12|stop-smoking-today|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunhuivchainakonchaj.cn (zeus)"; content:"|14|sunhuivchainakonchaj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-choicenow1.cn (exploit)"; content:"|10|super-choicenow1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superchoice-here2.cn (exploit)"; content:"|11|superchoice-here2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superchoice-now1.cn (exploit)"; content:"|10|superchoice-now1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supreme.web.imagine.co.za (koobface)"; content:"|07|supreme|03|web|07|imagine|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabdesign.com.sg (koobface)"; content:"|09|tabdesign|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tatuajeblog.com (zeus)"; content:"|0b|tatuajeblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tehreek.org.pk (koobface)"; content:"|07|tehreek|03|org|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tellion.eu (malware)"; content:"|07|tellion|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teplomer1.czechian.net (koobface)"; content:"|09|teplomer1|08|czechian|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesecurityutility.net (rogue)"; content:"|12|thesecurityutility|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titansecure001.com (rogue)"; content:"|0e|titansecure001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titansecure002.com (rogue)"; content:"|0e|titansecure002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tolima.cn (zeus)"; content:"|06|tolima|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomorrrrow.cn (c&c)"; content:"|0a|tomorrrrow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbillboardhits.cn (zeus)"; content:"|10|topbillboardhits|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topspeeds.cn (malware)"; content:"|09|topspeeds|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalcaresix.net (rogue)"; content:"|0c|totalcaresix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tp.dawnofmetal.at (koobface)"; content:"|02|tp|0b|dawnofmetal|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficrevenue.org (zeus)"; content:"|0e|trafficrevenue|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transfertplus.com (koobface)"; content:"|0d|transfertplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transliators.cn (zeus)"; content:"|0c|transliators|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup troyproductions.com (koobface)"; content:"|0f|troyproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uhcwuppenau.ch (koobface)"; content:"|0b|uhcwuppenau|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unacorn.net (koobface)"; content:"|07|unacorn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us536368.bizhostnet.com (koobface)"; content:"|08|us536368|0a|bizhostnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrv101.com (zeus)"; content:"|07|usrv101|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuviet.toila.net (koobface)"; content:"|06|uuviet|05|toila|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup velocityps.com (koobface)"; content:"|0a|velocityps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfgtyp.com (trojan)"; content:"|06|vfgtyp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vicerexshop.com (koobface)"; content:"|0b|vicerexshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup villa-azur-djb.com (koobface)"; content:"|0e|villa-azur-djb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vir-curemypc-now.com (rogue)"; content:"|10|vir-curemypc-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vircheckpc.com (rogue)"; content:"|0a|vircheckpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vostravauxcleenmain.com (koobface)"; content:"|13|vostravauxcleenmain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuaron2.cn (exploit)"; content:"|07|vuaron2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webstudium.com.br (trojan)"; content:"|0a|webstudium|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weeklytop.cn (trojan)"; content:"|09|weeklytop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weibell.no (koobface)"; content:"|07|weibell|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whatsupgreenville.com (koobface)"; content:"|11|whatsupgreenville|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizzelheadclub.com (koobface)"; content:"|0e|wizzelheadclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldclassinvestmentsllc.org (koobface)"; content:"|18|worldclassinvestmentsllc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldofcole.com (koobface)"; content:"|0b|worldofcole|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrbs.reallifematters.com (koobface)"; content:"|04|wrbs|0f|reallifematters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-desc.info (zeus)"; content:"|06|x-desc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiphrix.customer.attikh.net (zeus)"; content:"|07|xiphrix|08|customer|06|attikh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yellowsoft.org (trojan)"; content:"|0a|yellowsoft|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbad.co.im (zeus)"; content:"|06|yhnbad|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbad.com.im (zeus)"; content:"|06|yhnbad|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbad.im (zeus)"; content:"|06|yhnbad|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbad.net.im (zeus)"; content:"|06|yhnbad|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbak.co.im (zeus)"; content:"|06|yhnbak|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbak.com.im (zeus)"; content:"|06|yhnbak|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbak.im (zeus)"; content:"|06|yhnbak|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbak.net.im (zeus)"; content:"|06|yhnbak|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbak.org.im (zeus)"; content:"|06|yhnbak|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbam.co.im (zeus)"; content:"|06|yhnbam|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbam.com.im (zeus)"; content:"|06|yhnbam|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbam.im (zeus)"; content:"|06|yhnbam|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbam.net.im (zeus)"; content:"|06|yhnbam|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnbam.org.im (zeus)"; content:"|06|yhnbam|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youaskedthedomain.cn (c&c)"; content:"|11|youaskedthedomain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourgunparts.com (backdoor)"; content:"|0c|yourgunparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4l.co.im (zeus)"; content:"|06|yttt4l|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4l.com.im (zeus)"; content:"|06|yttt4l|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4l.im (zeus)"; content:"|06|yttt4l|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4l.net.im (zeus)"; content:"|06|yttt4l|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4l.org.im (zeus)"; content:"|06|yttt4l|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4r.co.im (zeus)"; content:"|06|yttt4r|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4r.com.im (zeus)"; content:"|06|yttt4r|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4r.im (zeus)"; content:"|06|yttt4r|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4r.net.im (zeus)"; content:"|06|yttt4r|03|net|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yttt4r.org.im (zeus)"; content:"|06|yttt4r|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z2.przeklej.pl (trojan)"; content:"|02|z2|08|przeklej|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zachman.orgfree.com (zeus)"; content:"|07|zachman|07|orgfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zu.ktk.ru (koobface)"; content:"|02|zu|03|ktk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010scannera1.com (koobface)"; content:"|0d|2010scannera1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareformac.com (harmful)"; content:"|11|antispywareformac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirustooledit.com (harmful)"; content:"|11|antivirustooledit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspyvarescanshop.com (harmful)"; content:"|13|antyspyvarescanshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusinstrument.com (harmful)"; content:"|13|antyvirusinstrument|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyvirusserviceblog.com (harmful)"; content:"|14|antyvirusserviceblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ardeana-couture.com (koobface)"; content:"|0f|ardeana-couture|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyprotection001.com (koobface)"; content:"|11|armyprotection001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyprotection009.com (koobface)"; content:"|11|armyprotection009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyprotection4.com (koobface)"; content:"|0f|armyprotection4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artificial2010.com (koobface)"; content:"|0e|artificial2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup attention-scanner.com (koobface)"; content:"|11|attention-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-antivirus9.com (rogue)"; content:"|0f|best-antivirus9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-wishes-design.com (koobface)"; content:"|12|best-wishes-design|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispywaresoft.com (harmful)"; content:"|13|bestantispywaresoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdiscounts2010.com (koobface)"; content:"|11|bestdiscounts2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestparty2009.com (koobface)"; content:"|0d|bestparty2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestparty2010.com (harmful)"; content:"|0d|bestparty2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestpffers2010.com (koobface)"; content:"|0e|bestpffers2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecuritymall.com (harmful)"; content:"|10|bestsecuritymall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestyearparty.com (koobface)"; content:"|0d|bestyearparty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebrate-designs.com (koobface)"; content:"|11|celebrate-designs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebrate2009year.com (koobface)"; content:"|11|celebrate2009year|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epilot.com (highrisk)"; content:"|06|epilot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eremovemondo.com (harmful)"; content:"|0c|eremovemondo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeserials.spb.ru (malware)"; content:"|0b|freeserials|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happy-newyear2010.com (koobface)"; content:"|11|happy-newyear2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homescanstores.com (harmful)"; content:"|0e|homescanstores|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hter4ree.com (fastflux)"; content:"|08|hter4ree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hter4req.net (fastflux)"; content:"|08|hter4req|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hter4ret.net (fastflux)"; content:"|08|hter4ret|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hter4rew.com (fastflux)"; content:"|08|hter4rew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetproscanm.com (koobface)"; content:"|10|internetproscanm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetproscanq.com (koobface)"; content:"|10|internetproscanq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetproscanr.com (koobface)"; content:"|10|internetproscanr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetproscanw.com (koobface)"; content:"|10|internetproscanw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetproscany.com (koobface)"; content:"|10|internetproscany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lindaagora.150m.com (harmful)"; content:"|0a|lindaagora|04|150m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linux-rootkit.com (harmful)"; content:"|0d|linux-rootkit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarescanguide.com (harmful)"; content:"|10|malwarescanguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwaretake.com (harmful)"; content:"|0b|malwaretake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcafeevirusremover.com (harmful)"; content:"|12|mcafeevirusremover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megascannera.com (koobface)"; content:"|0c|megascannera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasecurityl.com (koobface)"; content:"|0d|megasecurityl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasecurityp.com (koobface)"; content:"|0d|megasecurityp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasecurityq.com (koobface)"; content:"|0d|megasecurityq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mstopantivir.com (koobface)"; content:"|0c|mstopantivir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nei28.com (zeus)"; content:"|05|nei28|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-download-free.net (malicious)"; content:"|11|net-download-free|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netantivirus.net (malicious)"; content:"|0c|netantivirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netscapeweb.org (rogue)"; content:"|0b|netscapeweb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newholidaydesigns.com (koobface)"; content:"|11|newholidaydesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newyearandsanta.com (koobface)"; content:"|0f|newyearandsanta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newyeardesgings.com (koobface)"; content:"|0f|newyeardesgings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njoykorea.com (malicious)"; content:"|09|njoykorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup not99.biz (exploit)"; content:"|05|not99|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns-srv10.com (malware)"; content:"|08|ns-srv10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ny-federalreservebank.net (exploit)"; content:"|15|ny-federalreservebank|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oboy25.cn (zeus)"; content:"|06|oboy25|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-defense7.com (koobface)"; content:"|0f|online-defense7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-securtiyv1.com (koobface)"; content:"|11|online-securtiyv1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-securtiyv4.com (koobface)"; content:"|11|online-securtiyv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-securtiyv5.com (koobface)"; content:"|11|online-securtiyv5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantimalwareworld.com (harmful)"; content:"|16|onlineantimalwareworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinegames25.net (zbot)"; content:"|0d|onlinegames25|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityn1.com (koobface)"; content:"|10|onlinesecurityn1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityn2.com (koobface)"; content:"|10|onlinesecurityn2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityn3.com (koobface)"; content:"|10|onlinesecurityn3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityn4.com (koobface)"; content:"|10|onlinesecurityn4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesecurityn5.com (koobface)"; content:"|10|onlinesecurityn5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineviruskilla0.com (koobface)"; content:"|11|onlineviruskilla0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineviruskilla2.com (koobface)"; content:"|11|onlineviruskilla2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineviruskilla4.com (koobface)"; content:"|11|onlineviruskilla4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineviruskilla6.com (harmful)"; content:"|11|onlineviruskilla6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineviruskilla8.com (koobface)"; content:"|11|onlineviruskilla8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinewebhits.com (harmful)"; content:"|0d|onlinewebhits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orbapou.net (fastflux)"; content:"|07|orbapou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-guard2010.com (malicious)"; content:"|0c|os-guard2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-guardpro2009.com (malicious)"; content:"|0f|os-guardpro2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-guardpro2010.com (malicious)"; content:"|0f|os-guardpro2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup owndefender.com (rogue)"; content:"|0b|owndefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partner777.net (harmfull)"; content:"|0a|partner777|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-scanner-2012.net (harmfull)"; content:"|0f|pc-scanner-2012|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-securityv4.com (harmful)"; content:"|0d|pc-securityv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-securityv6.com (malicious)"; content:"|0d|pc-securityv6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-securityv8.com (malicious)"; content:"|0d|pc-securityv8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pca.uub.cc (harmfull)"; content:"|03|pca|03|uub|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchomei5.info (harmfull)"; content:"|08|pchomei5|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalprotectorv2.net (malicious)"; content:"|13|personalprotectorv2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozemle.cn (trrojan)"; content:"|07|pozemle|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup publicsecuritygroup.com (harmful)"; content:"|13|publicsecuritygroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxcallcentercareersx333.com (zeus)"; content:"|17|pxcallcentercareersx333|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qzeo-ad.info (exploit)"; content:"|07|qzeo-ad|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup removevirustoolonline.com (harmful)"; content:"|15|removevirustoolonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubber-plant.cn (malicious)"; content:"|0c|rubber-plant|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rulzan.com (virus)"; content:"|06|rulzan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safescannern1.com (harmful)"; content:"|0d|safescannern1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santa-christmas2010.com (koobface)"; content:"|13|santa-christmas2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-spyware2.com (koobface)"; content:"|0d|scan-spyware2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanfreeonline.com (harmful)"; content:"|0e|scanfreeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannetinc.com (harmful)"; content:"|0a|scannetinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scykocn.net (zeus)"; content:"|07|scykocn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityonlineforum.net (harmful)"; content:"|13|securityonlineforum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftblog.com (harmful)"; content:"|10|securitysoftblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysofts.net (harmful)"; content:"|0d|securitysofts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snowandchristmas.com (harmful)"; content:"|10|snowandchristmas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareremovediretto.com (harmful)"; content:"|14|spywareremovediretto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superprotection3.com (koobface)"; content:"|10|superprotection3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tcp3.com (harmful)"; content:"|04|tcp3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ter3awqlvr.com.pl (fastflux)"; content:"|0a|ter3awqlvr|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ter3awqlwt.com.pl (fastflux)"; content:"|0a|ter3awqlwt|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantivirusfree.com (harmful)"; content:"|10|theantivirusfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantispys.com (koobface)"; content:"|0f|thebestantispys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantispywarei.com (harmful)"; content:"|13|thebestantispywarei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantivirusa.com (harmful)"; content:"|11|thebestantivirusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantivirusb.com (harmful)"; content:"|11|thebestantivirusb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantivirusg.com (harmful)"; content:"|11|thebestantivirusg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestantivirusr.com (harmful)"; content:"|11|thebestantivirusr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thecreativevirus.com (harmful)"; content:"|10|thecreativevirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themalwarescan.com (harmful)"; content:"|0e|themalwarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topscan2.com (scareware)"; content:"|08|topscan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transportvirustool.com (harmful)"; content:"|12|transportvirustool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojanread.com (harmful)"; content:"|0a|trojanread|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustreasurynet.net (malicious)"; content:"|0d|ustreasurynet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vinfoonline.com (trojan)"; content:"|0b|vinfoonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virtualemediasoft.com (trojan)"; content:"|11|virtualemediasoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-pcscan.com (koobface)"; content:"|0c|virus-pcscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websafetybox.com (harmful)"; content:"|0c|websafetybox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westflashdate.com (trojan)"; content:"|0d|westflashdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weststartelecom.com (malicious)"; content:"|0f|weststartelecom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winguardsite.com (rogue)"; content:"|0c|winguardsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winrescueupdate.com (koobface)"; content:"|0f|winrescueupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winscanner18.com (scareware)"; content:"|0c|winscanner18|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldprotection.net (malicious)"; content:"|0f|worldprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y7y66yd.com.pl (fastflux)"; content:"|07|y7y66yd|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y7y66yg.com.pl (fastflux)"; content:"|07|y7y66yg|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y7y66yj.com.pl (fastflux)"; content:"|07|y7y66yj|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y7y66yu.com.pl (fastflux)"; content:"|07|y7y66yu|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yeartiger.cn (malware)"; content:"|09|yeartiger|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-protection8.com (scareware)"; content:"|10|your-protection8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourchecksun.com (harmful)"; content:"|0c|yourchecksun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z1-scanner.com (harmful)"; content:"|0a|z1-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z6scanner.com (harmful)"; content:"|09|z6scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z7scanner.com (harmful)"; content:"|09|z7scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zguard-data.com (rogue)"; content:"|0b|zguard-data|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zguarddata.com (rogue)"; content:"|0a|zguarddata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3322.org (malware)"; content:"|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-roi.jp (threat)"; content:"|05|a-roi|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 125.nilshagen.com (rootkit)"; content:"|03|125|09|nilshagen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24zz.co.cc (zeus/wsnpoem)"; content:"|04|24zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 364736.com (malware)"; content:"|06|364736|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 41z.com (rogue)"; content:"|03|41z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4ura.us (risk)"; content:"|04|4ura|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 88888wyt.com (malware)"; content:"|08|88888wyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 999fu.cn (malware)"; content:"|05|999fu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adsense-market.com (rogue)"; content:"|0e|adsense-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-spyware26.com (rogue)"; content:"|0e|anti-spyware26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware11scan.com (rogue)"; content:"|11|antispyware11scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware12scan.com (rogue)"; content:"|11|antispyware12scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware13scan.com (rogue)"; content:"|11|antispyware13scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware15scan.com (rogue)"; content:"|11|antispyware15scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware17scan.com (rogue)"; content:"|11|antispyware17scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarescan51.com (rogue)"; content:"|11|antispywarescan51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarescan52.com (rogue)"; content:"|11|antispywarescan52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspc-update.com (c&c)"; content:"|12|antiviruspc-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspc2009.com (Rogue)"; content:"|0f|antiviruspc2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusscansite.com (rogue)"; content:"|11|antivirusscansite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusscanstore.com (rogue)"; content:"|12|antivirusscanstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antyspyvarescanonline.com (rogue)"; content:"|15|antyspyvarescanonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atinna.com (zeus/wsnpoem)"; content:"|06|atinna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b1sh0p.fileave.com (zeus)"; content:"|06|b1sh0p|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagtrustik.cn (zeus/wsnpoem)"; content:"|0a|bagtrustik|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestesecurity.com (trojan)"; content:"|0d|bestesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestpmgroup.com (zeus/wsnpoem)"; content:"|0b|bestpmgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestyearantispy5.com (rogue)"; content:"|10|bestyearantispy5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bewray.info (rogue)"; content:"|06|bewray|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bezsdornost.info (exploit)"; content:"|0b|bezsdornost|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bind88.com (malware)"; content:"|06|bind88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackchimp.com (zeus/wsnpoem)"; content:"|0a|blackchimp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centuriox.info (zeus/wsnpoem)"; content:"|09|centuriox|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check4-forvir.net (rogue)"; content:"|0d|check4-forvir|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrisbecfiis.com (exploit)"; content:"|0c|chrisbecfiis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compy.info (exploit)"; content:"|05|compy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cunamot.cn (rogue)"; content:"|07|cunamot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dexlife.com (trojan)"; content:"|07|dexlife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dh818.com (malware)"; content:"|05|dh818|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup driverupdateter.cn (zeus)"; content:"|0f|driverupdateter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erthjuyt44u.com (zeus)"; content:"|0b|erthjuyt44u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erwalk.info (rogue)"; content:"|06|erwalk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellenthostingservice.com (zeus)"; content:"|17|excellenthostingservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezenyv.cn (rogue)"; content:"|06|ezenyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezoheyx.cn (rogue)"; content:"|07|ezoheyx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezouwi.cn (rogue)"; content:"|06|ezouwi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feelcleardown.net (Rogue)"; content:"|0d|feelcleardown|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplayeradobe.com (zeus/wsnpoem)"; content:"|10|flashplayeradobe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flo5.cn (exploit)"; content:"|04|flo5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flower-show.org (exploit)"; content:"|0b|flower-show|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footballcappers.biz (exploit)"; content:"|0f|footballcappers|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forumsblog.info (exploit)"; content:"|0a|forumsblog|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-led-matrix.com (rogue)"; content:"|0f|full-led-matrix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamecp12.cn (zeus/wsnpoem)"; content:"|08|gamecp12|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamesforums.info (exploit)"; content:"|0b|gamesforums|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gifts2010.net (malware)"; content:"|09|gifts2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginmap.cn (trojan)"; content:"|06|ginmap|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldhostingservice.com (zeus)"; content:"|12|goldhostingservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatdefender.com (Rogue)"; content:"|0d|greatdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grizzli-counter.com (trojan)"; content:"|0f|grizzli-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holiday-spirits.com (Rogue)"; content:"|0f|holiday-spirits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horum.info (rogue)"; content:"|05|horum|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iproxy.nl (zeus/wsnpoem)"; content:"|06|iproxy|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itmasterz.org (exploit)"; content:"|09|itmasterz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaizerr.org (zeus/wsnpoem)"; content:"|07|kaizerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-malware-012.com (Rogue)"; content:"|10|kill-malware-012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kotopes.cn (exploit)"; content:"|07|kotopes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laryju.info (threat)"; content:"|06|laryju|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup majorsoftwareupdate.info (trojan)"; content:"|13|majorsoftwareupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missing-codecs.cn (trojan)"; content:"|0e|missing-codecs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmolords.cn (zeus/wsnpoem)"; content:"|08|mmolords|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molendf.co.kr (fastflux)"; content:"|07|molendf|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molendf.com (fastflux)"; content:"|07|molendf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molendf.kr (fastflux)"; content:"|07|molendf|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molendf.ne.kr (fastflux)"; content:"|07|molendf|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molendf.or.kr (fastflux)"; content:"|07|molendf|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynetstat.biz (trojan)"; content:"|09|mynetstat|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myreservedomainforz6.net (zeus)"; content:"|14|myreservedomainforz6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myreservedomainforz7.net (zeus)"; content:"|14|myreservedomainforz7|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzipitfast.net (exploit)"; content:"|0b|myzipitfast|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nekovo.ru (zeus)"; content:"|06|nekovo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsdownloads.cn (c&c)"; content:"|0d|newsdownloads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnfoehfeff.com (exploit)"; content:"|0a|nnfoehfeff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyware611.com (rogue)"; content:"|15|online-antispyware611|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantispyworld.com (rogue)"; content:"|12|onlineantispyworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantivirus46.com (rogue)"; content:"|11|onlineantivirus46|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup only-free-videos.info (rogue)"; content:"|10|only-free-videos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outlawyoung972.com (zeus)"; content:"|0e|outlawyoung972|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup papaanarhia.cn (trojan)"; content:"|0b|papaanarhia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parades-party.com (Rogue)"; content:"|0d|parades-party|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privetsite.in (iframe)"; content:"|0a|privetsite|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-my-system.com (rogue)"; content:"|11|protect-my-system|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvodax.cn (malware)"; content:"|06|qvodax|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapidgatewave.com (zeus/wsnpoem)"; content:"|0d|rapidgatewave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rasejo.cn (zeus)"; content:"|06|rasejo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realbossa.net (zeus)"; content:"|09|realbossa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recessa.ru (zeus/wsnpoem)"; content:"|07|recessa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanlifelive.com (rogue)"; content:"|0c|scanlifelive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selladvice.cn (zeus/wsnpoem)"; content:"|0a|selladvice|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servscanner01.com (harmful)"; content:"|0d|servscanner01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexmoney.com (risk)"; content:"|08|sexmoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skje.info (exploit)"; content:"|04|skje|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-shake.com (rogue)"; content:"|0b|smart-shake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socks5servise.com (trojan)"; content:"|0d|socks5servise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softportal.cn (zeus)"; content:"|0a|softportal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solodov.in (exploit)"; content:"|07|solodov|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-remove94.com (rogue)"; content:"|10|spyware-remove94|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareretransitiondiretto.com (rogue)"; content:"|1a|spywareretransitiondiretto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfilmutilites.com (rogue)"; content:"|11|superfilmutilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susund4.cn (iframe)"; content:"|07|susund4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tds-info.net (exploit)"; content:"|08|tds-info|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamerblog.com (virus)"; content:"|0a|teamerblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjiks.co.im (fastflux)"; content:"|06|ujjiks|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjiks.com.im (fastflux)"; content:"|06|ujjiks|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjiks.org.im (fastflux)"; content:"|06|ujjiks|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjikx.co.im (fastflux)"; content:"|06|ujjikx|02|co|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjikx.com.im (fastflux)"; content:"|06|ujjikx|03|com|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjikx.org.im (fastflux)"; content:"|06|ujjikx|03|org|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usastopaids.org (zeus/wsnpoem)"; content:"|0b|usastopaids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useranalyticsreporting.net (exploit)"; content:"|16|useranalyticsreporting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcrssd1.cc (fastflux)"; content:"|07|vcrssd1|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcrssd1.eu (fastflux)"; content:"|07|vcrssd1|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfrtssd.com (fastflux)"; content:"|07|vfrtssd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videos-for-free1.info (rogue)"; content:"|10|videos-for-free1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videos-for-free2.info (rogue)"; content:"|10|videos-for-free2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videos-for-free3.info (rogue)"; content:"|10|videos-for-free3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videos-for-free4.info (rogue)"; content:"|10|videos-for-free4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voiew.com (trojan)"; content:"|05|voiew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmprot.co.uk (fastflux)"; content:"|07|vsmprot|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmprot.com (fastflux)"; content:"|07|vsmprot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmprot.eu (fastflux)"; content:"|07|vsmprot|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmprot.me.uk (fastflux)"; content:"|07|vsmprot|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmprot.org.uk (zeus)"; content:"|07|vsmprot|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuicy.com (trojan)"; content:"|05|vuicy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-information-services.com (zeus)"; content:"|18|web-information-services|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westnorths.cn (exploit)"; content:"|0a|westnorths|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-tube.org (trojan)"; content:"|0a|white-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-xxx-tube.com (rogue)"; content:"|0e|white-xxx-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-xxxx-tube.com (rogue)"; content:"|0f|white-xxxx-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitejewells.com (iframe)"; content:"|0c|whitejewells|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvgoldwings.com (exploit)"; content:"|0b|wvgoldwings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwealthprivate.info (zeus/wsnpoem)"; content:"|0e|xwealthprivate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xwealthprivates.info (zeus/wsnpoem)"; content:"|0f|xwealthprivates|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxi.ss.la (malware)"; content:"|03|xxi|02|ss|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trta.com.pl (fastflux)"; content:"|08|yht5trta|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trtb.com.pl (fastflux)"; content:"|08|yht5trtb|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trtd.com.pl (fastflux)"; content:"|08|yht5trtd|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trte.com.pl (fastflux)"; content:"|08|yht5trte|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trth.com.pl (fastflux)"; content:"|08|yht5trth|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trtq.com.pl (fastflux)"; content:"|08|yht5trtq|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trts.com.pl (fastflux)"; content:"|08|yht5trts|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trtu.com.pl (fastflux)"; content:"|08|yht5trtu|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trty.com.pl (fastflux)"; content:"|08|yht5trty|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yht5trtz.com.pl (fastflux)"; content:"|08|yht5trtz|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourremover.com (rogue)"; content:"|0b|yourremover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zennullvoid.org (exploit)"; content:"|0b|zennullvoid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup briankc.com (threat)"; content:"|07|briankc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d67c.cn (threat)"; content:"|04|d67c|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1155g.cn (trojan )"; content:"|05|1155g|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1188d.cn (trojan )"; content:"|05|1188d|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 28zz.co.cc (zeus)"; content:"|04|28zz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 35tr.co.tv (zeus)"; content:"|04|35tr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3hq.co.cc (zeus)"; content:"|03|3hq|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3m70.cn (trojan)"; content:"|04|3m70|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4vv.co.cc (zeus)"; content:"|03|4vv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5bn.co.cc (zeus)"; content:"|03|5bn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 73sp.co.cc (zeus)"; content:"|04|73sp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 853c9e57.biz (controllers)"; content:"|08|853c9e57|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admiin.ru (botnet)"; content:"|06|admiin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advertcatalogwww.biz (exploits)"; content:"|10|advertcatalogwww|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aemtool.com (trojan)"; content:"|07|aemtool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afkcgicyxcri.com (exploits)"; content:"|0c|afkcgicyxcri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajsbdicijbps.com (exploits)"; content:"|0c|ajsbdicijbps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup albr1.org (trojan )"; content:"|05|albr1|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amhes.com (malware)"; content:"|05|amhes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armtol.com (trojan)"; content:"|06|armtol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup art-port.net (malware)"; content:"|08|art-port|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artswoodfloors.com (malware)"; content:"|0e|artswoodfloors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badware-exterminator.biz (rogue)"; content:"|14|badware-exterminator|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badware-exterminator.net (rogue)"; content:"|14|badware-exterminator|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badware-exterminator.org (rogue)"; content:"|14|badware-exterminator|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badwareextermenator.biz (rogue)"; content:"|13|badwareextermenator|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badwareexterminator.biz (rogue)"; content:"|13|badwareexterminator|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badwareexterminator.com (rogue)"; content:"|13|badwareexterminator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badwareexterminator.net (rogue)"; content:"|13|badwareexterminator|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcjiqkguno.net (exploits)"; content:"|0a|bcjiqkguno|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellians.com (trojan)"; content:"|08|bellians|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bglhqjakihvy.com (exploits)"; content:"|0c|bglhqjakihvy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigfreepackage.com (rogue)"; content:"|0e|bigfreepackage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitardhqpaid.com (exploits)"; content:"|0c|bitardhqpaid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitlaadutlcy.com (exploits)"; content:"|0c|bitlaadutlcy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biyiagigfiyy.com (exploits)"; content:"|0c|biyiagigfiyy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butirat.com (malware)"; content:"|07|butirat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camcamera.com (malware)"; content:"|09|camcamera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chatpartyline.com (malware)"; content:"|0d|chatpartyline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chocolatery.info (zeus)"; content:"|0b|chocolatery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chwidiglkiad.com (exploits)"; content:"|0c|chwidiglkiad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnc.vostock.org (rogue)"; content:"|03|cnc|07|vostock|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystal-arts.net (malware)"; content:"|0c|crystal-arts|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup darksteps.3utilities.com (malware)"; content:"|09|darksteps|0a|3utilities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dunered.com (fastflux)"; content:"|07|dunered|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup editedout.cn (malware)"; content:"|09|editedout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evamendesochka.com (malware)"; content:"|0e|evamendesochka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exe.137j.com (trojan )"; content:"|03|exe|04|137j|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favolu.com (exploit)"; content:"|06|favolu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fcrazy.eu (exploits)"; content:"|06|fcrazy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fcrazy.info (zeus)"; content:"|06|fcrazy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgage.com (malware)"; content:"|05|fgage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-arts-2009.com (malware)"; content:"|0e|free-arts-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gymandcardio.cn (malware)"; content:"|0c|gymandcardio|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hack-off.info (controllers)"; content:"|08|hack-off|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heswar.com (malware)"; content:"|06|heswar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houseartsarea.com (malware)"; content:"|0d|houseartsarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsbc-trial.co.uk (zeus)"; content:"|0a|hsbc-trial|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intelligentservice.biz (zeus)"; content:"|12|intelligentservice|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interhomesite.com (malware)"; content:"|0d|interhomesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interhostingservicesnet.com (zeus)"; content:"|17|interhostingservicesnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jet-arts-center.com (malware)"; content:"|0f|jet-arts-center|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jqc.ic.cz (zbot)"; content:"|03|jqc|02|ic|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumbotubes.com (malware)"; content:"|0a|jumbotubes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karma.collection.pk (zeus)"; content:"|05|karma|0a|collection|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keffi.ic.cz (zeus)"; content:"|05|keffi|02|ic|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makingtmoney.info (rogue)"; content:"|0c|makingtmoney|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makingtmoneyadv.info (rogue)"; content:"|0f|makingtmoneyadv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makingtmoneybanner.info (rogue)"; content:"|12|makingtmoneybanner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makingtmoneydown.info (rogue)"; content:"|10|makingtmoneydown|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mangoclub301.eu (rogue)"; content:"|0c|mangoclub301|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaartsgallery.net (malware)"; content:"|10|mediaartsgallery|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadriveonline.com (rogue)"; content:"|10|mediadriveonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaloadfile.com (malware)"; content:"|0c|megaloadfile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro-scanner1.com (rogue)"; content:"|0e|micro-scanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro-scanner3.com (rogue)"; content:"|0e|micro-scanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro-scanner4.com (rogue)"; content:"|0e|micro-scanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro-scanner5.com (rogue)"; content:"|0e|micro-scanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscanner1.com (rogue)"; content:"|0d|microscanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscanner2.com (rogue)"; content:"|0d|microscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscanner3.com (rogue)"; content:"|0d|microscanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscanner4.com (rogue)"; content:"|0d|microscanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microscanner5.com (rogue)"; content:"|0d|microscanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mineralcarebeauty.info (rogue)"; content:"|11|mineralcarebeauty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mineralcarebeautyadv23.info (rogue)"; content:"|16|mineralcarebeautyadv23|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mineralcarebeautyadv24.info (rogue)"; content:"|16|mineralcarebeautyadv24|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtm5omt.info (rogue)"; content:"|07|mtm5omt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtm9wqz.in (rogue)"; content:"|07|mtm9wqz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtmadvgb.info (rogue)"; content:"|08|mtmadvgb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myf2you.com (malware)"; content:"|07|myf2you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-search-zone.com (malware)"; content:"|0f|new-search-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmediatravel.net (rogue)"; content:"|0e|newmediatravel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newvirusbexsite.com (fraud)"; content:"|0f|newvirusbexsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newvirusbexstore.com (fraud)"; content:"|10|newvirusbexstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oughwa.com (exploit)"; content:"|06|oughwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oulimelsisi.com (zeus)"; content:"|0b|oulimelsisi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcprotectar.com (rogue)"; content:"|0b|pcprotectar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pramoditya.com (zeus)"; content:"|0a|pramoditya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protwork.com (malware)"; content:"|08|protwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0313517889.kt.io (exploits)"; content:"|0b|q0313517889|02|kt|02|io"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qtdyf.cn (malware)"; content:"|05|qtdyf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safarel.com (malware)"; content:"|07|safarel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safewhales.ws (zeus/wsnpoem)"; content:"|0a|safewhales|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware01.com (rogue)"; content:"|11|scanner-malware01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware02.com (rogue)"; content:"|11|scanner-malware02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware04.com (rogue)"; content:"|11|scanner-malware04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware05.com (rogue)"; content:"|11|scanner-malware05|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware06.com (rogue)"; content:"|11|scanner-malware06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware11.com (rogue)"; content:"|11|scanner-malware11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware12.com (rogue)"; content:"|11|scanner-malware12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-malware13.com (rogue)"; content:"|11|scanner-malware13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scrollin.com (zeus)"; content:"|08|scrollin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seekingout.cn (trojan )"; content:"|0a|seekingout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showmelovetube.cn (malware)"; content:"|0e|showmelovetube|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soilness.com (malware)"; content:"|08|soilness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spendolo.com (zeus)"; content:"|08|spendolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stickingout.cn (trojan )"; content:"|0b|stickingout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superartswood.com (malware)"; content:"|0d|superartswood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susund2.cn (malware)"; content:"|07|susund2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susund5.cn (malware)"; content:"|07|susund5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susund6.cn (malware)"; content:"|07|susund6|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thezasite.com (malware)"; content:"|09|thezasite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvartsonline.com (trojan )"; content:"|0c|tvartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uk.69.mu (zeus)"; content:"|02|uk|02|69|02|mu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirusq10.com (rogue)"; content:"|10|web-antivirusq10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirusq20.com (rogue)"; content:"|10|web-antivirusq20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirusq30.com (rogue)"; content:"|10|web-antivirusq30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirusq60.com (rogue)"; content:"|10|web-antivirusq60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirusq90.com (rogue)"; content:"|10|web-antivirusq90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wermacht.net (zeus)"; content:"|08|wermacht|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wopayments.com (fraud)"; content:"|0a|wopayments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yespacknet.org (exploit)"; content:"|0a|yespacknet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourgot.com (malware)"; content:"|07|yourgot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebazaar.gr (zeus)"; content:"|07|ebazaar|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellentesecurity.com (trojan)"; content:"|12|excellentesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrassecurityonline.com (trojan)"; content:"|14|extrassecurityonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrassecuritysite.com (trojan)"; content:"|12|extrassecuritysite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusscansite.com (rogue)"; content:"|0d|virusscansite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allprotections.com (malware)"; content:"|0e|allprotections|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2611606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allsecurepages.com (malware)"; content:"|0e|allsecurepages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allsecuritylinks.com (malware)"; content:"|10|allsecuritylinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2612052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allsecuritynotes.com (coolwebsearch)"; content:"|10|allsecuritynotes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2612562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feastfashion.com (exploit)"; content:"|0c|feastfashion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1federal.org (phishing)"; content:"|08|1federal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 524ay.cn (zeus)"; content:"|05|524ay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrologic.in (malware)"; content:"|09|acrologic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe5-peltion.cn (zeus)"; content:"|0e|adobe5-peltion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe9-mytdup.cn (zeus)"; content:"|0d|adobe9-mytdup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfanethost.com (phishing)"; content:"|0b|alfanethost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ampsguide.ru (malware)"; content:"|09|ampsguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analexpired.com (harmful)"; content:"|0b|analexpired|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-scanner051.com (malware)"; content:"|15|anti-virus-scanner051|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-virus-scanner071.com (malware)"; content:"|15|anti-virus-scanner071|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisollushin.cn (malware)"; content:"|0d|antisollushin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-l14.com (risk)"; content:"|0f|antispyware-l14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-free-scan01.com (trojan )"; content:"|14|antivrus-free-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-free-scan02.com (trojan )"; content:"|14|antivrus-free-scan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-free-scan04.com (trojan )"; content:"|14|antivrus-free-scan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-freescan01.com (rogue)"; content:"|13|antivrus-freescan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-freescan02.com (rogue)"; content:"|13|antivrus-freescan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-freescan04.com (rogue)"; content:"|13|antivrus-freescan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-freescan07.com (rogue)"; content:"|13|antivrus-freescan07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrus-freescan08.com (rogue)"; content:"|13|antivrus-freescan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrusfreescan01.com (rogue)"; content:"|12|antivrusfreescan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrusfreescan02.com (rogue)"; content:"|12|antivrusfreescan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrusfreescan04.com (rogue)"; content:"|12|antivrusfreescan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrusfreescan07.com (rogue)"; content:"|12|antivrusfreescan07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivrusfreescan08.com (rogue)"; content:"|12|antivrusfreescan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquawebhost.com (phishing)"; content:"|0b|aquawebhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atomniekacheli.in (malware)"; content:"|0e|atomniekacheli|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backup2010.com (zeus)"; content:"|0a|backup2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banquetepordiosero.com.ar (malware)"; content:"|12|banquetepordiosero|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbob.ru (malware)"; content:"|07|bestbob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boing747.net (zeus)"; content:"|08|boing747|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonnapet.com (malvertisement)"; content:"|08|bonnapet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burkewebservices.ru (malware)"; content:"|10|burkewebservices|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cache.ysbweb.com (malware)"; content:"|05|cache|06|ysbweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cajadomestic.org (zeus)"; content:"|0c|cajadomestic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital2009.com (malware)"; content:"|0b|capital2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carswebnet.ru (malware)"; content:"|0a|carswebnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casharray.com (malware)"; content:"|09|casharray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casting-web.com.ar (malware)"; content:"|0b|casting-web|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cchassejhuytr.com (phish)"; content:"|0d|cchassejhuytr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaassekjhqwe.com (phish)"; content:"|0d|chaassekjhqwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chhassekjhytre.com (phish)"; content:"|0e|chhassekjhytre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compris2fres7x.com (zeus)"; content:"|0e|compris2fres7x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dasfkjsdsfg.biz (malware)"; content:"|0b|dasfkjsdsfg|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddevi.3utilities.com (malware)"; content:"|05|ddevi|0a|3utilities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designer4host.com (malware)"; content:"|0d|designer4host|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dikoool.com (zeus)"; content:"|07|dikoool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup direcionex.info (malware)"; content:"|0a|direcionex|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dj4fe3d2.com (malware)"; content:"|08|dj4fe3d2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dl.divocodec.com (malware)"; content:"|02|dl|09|divocodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dl.qvod.com (malware)"; content:"|02|dl|04|qvod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlink4.biz (zeus)"; content:"|06|dlink4|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donald-dark.net (zeus)"; content:"|0b|donald-dark|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donccapone.com (zeus)"; content:"|0a|donccapone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donzongo.com (malware)"; content:"|08|donzongo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dowmowvid.ru (malware)"; content:"|09|dowmowvid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.9down.com (malware)"; content:"|08|download|05|9down|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.hottiestar.com (malware)"; content:"|08|download|0a|hottiestar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr22.com (malware)"; content:"|0d|downloadavr22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr25.com (malware)"; content:"|0d|downloadavr25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drive.dubaigatehost.com (malware)"; content:"|05|drive|0d|dubaigatehost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elochka.real-host.ru (zeus)"; content:"|07|elochka|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup els.mtwb.net (malware)"; content:"|03|els|04|mtwb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup els.mywebtattoo.com (malware)"; content:"|03|els|0b|mywebtattoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enterinput.com (malware)"; content:"|0a|enterinput|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evgonar.1gb.ru (zeus)"; content:"|07|evgonar|03|1gb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdglsoft.in (malware)"; content:"|08|fdglsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-al.com (malware)"; content:"|15|federalreservebank-al|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-nc.com (malware)"; content:"|15|federalreservebank-nc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-sd.com (malware)"; content:"|15|federalreservebank-sd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-tn.net (malware)"; content:"|15|federalreservebank-tn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup federalreservebank-tx.net (malware)"; content:"|15|federalreservebank-tx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fliegenfischen-lehmann.de (threat)"; content:"|16|fliegenfischen-lehmann|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup for.toh.info (malware)"; content:"|03|for|03|toh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fqfmyvii.cn (malware)"; content:"|08|fqfmyvii|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuckthecrisis.biz (malware)"; content:"|0d|fuckthecrisis|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funwebmail.ru (malware)"; content:"|0a|funwebmail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-antivirus.com (malware)"; content:"|11|general-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getbigfat.com (malware)"; content:"|09|getbigfat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghostsection.com (malware)"; content:"|0c|ghostsection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gnfdt.cn (malware)"; content:"|05|gnfdt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gova.8gcc.com (malware)"; content:"|04|gova|04|8gcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatlakesinspect.com (malware)"; content:"|11|greatlakesinspect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwebradio.ru (malware)"; content:"|0d|greatwebradio|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guriedu.go.kr (malware)"; content:"|07|guriedu|02|go|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idfc2.info (malware)"; content:"|05|idfc2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inputtaiment.com (malware)"; content:"|0c|inputtaiment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irc16.chat-land.org (malware)"; content:"|05|irc16|09|chat-land|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irc2.chat-land.org (malware)"; content:"|04|irc2|09|chat-land|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolordat482.com (malware)"; content:"|0b|kolordat482|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsggdniu.cn (malware)"; content:"|08|lsggdniu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwarebot.com (rogue)"; content:"|0a|malwarebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwaremechanic.com (malware)"; content:"|0f|malwaremechanic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-counter.com (malware)"; content:"|0c|mega-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ming-dun.com.tw (malware)"; content:"|08|ming-dun|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydatabasedirect.com (malware)"; content:"|10|mydatabasedirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhjayubnuno.com (malware)"; content:"|0b|nhjayubnuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ooowetr.lgg.ru (malware)"; content:"|07|ooowetr|03|lgg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opchki.ir (malware)"; content:"|06|opchki|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pgcnbgkk.cn (malware)"; content:"|08|pgcnbgkk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roycaetano.com.br (malware)"; content:"|0a|roycaetano|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russisches-staatsballett-perm.de (malware)"; content:"|1d|russisches-staatsballett-perm|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-now24.com (rogur)"; content:"|0a|scan-now24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scienceinvestments.net (malware)"; content:"|12|scienceinvestments|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytoolplayer.com (malware)"; content:"|12|securitytoolplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seleventy.com (malware)"; content:"|09|seleventy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup send2010.hpg.com.br (malware)"; content:"|08|send2010|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sertimof20.real-host.ru (zeus)"; content:"|0a|sertimof20|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-a55.net (malware)"; content:"|0a|server-a55|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-b37.net (malware)"; content:"|0a|server-b37|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-b77.net (malware)"; content:"|0a|server-b77|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-c02.net (malware)"; content:"|0a|server-c02|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-c26.net (malware)"; content:"|0a|server-c26|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-d50.net (malware)"; content:"|0a|server-d50|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server-e60.net (malware)"; content:"|0a|server-e60|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serviscentr.rv.ua (malware)"; content:"|0b|serviscentr|02|rv|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sicha-linna.com (zeus)"; content:"|0b|sicha-linna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silence7.homeip.net (zeus)"; content:"|08|silence7|06|homeip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skytz.org (malware)"; content:"|05|skytz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space.cachefly.net (malware)"; content:"|05|space|08|cachefly|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spfighter.com (malware)"; content:"|09|spfighter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyremover-k7.com (malware)"; content:"|0d|spyremover-k7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-10.cn (malware)"; content:"|0c|stallvars-10|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starware.com (risk)"; content:"|08|starware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suesite.ru (malware)"; content:"|07|suesite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superaguide.ru (malware)"; content:"|0b|superaguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superore.ru (malware)"; content:"|08|superore|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersmans.cn (malware)"; content:"|0a|supersmans|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swiftx.co.cc (malware)"; content:"|06|swiftx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telecarsys.it (malware)"; content:"|0a|telecarsys|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terman.info (malware)"; content:"|06|terman|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantyspywaretool.com (threat)"; content:"|12|theantyspywaretool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theaonline.ru (malware)"; content:"|0a|theaonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theatticsale.ru (malware)"; content:"|0c|theatticsale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theaworld.ru (malware)"; content:"|09|theaworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thechocolateweb.ru (malware)"; content:"|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelaceweb.ru (malware)"; content:"|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themobilewindow.ru (malware)"; content:"|0f|themobilewindow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepiggin.com (malware)"; content:"|09|thepiggin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traff.street-info.com (zeus)"; content:"|05|traff|0b|street-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trahme.ru (zeus)"; content:"|06|trahme|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transportools.com (malware)"; content:"|0d|transportools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubepornvideoethebest.com (malware)"; content:"|15|tubepornvideoethebest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update.vaccine-free.co.kr (malware)"; content:"|06|update|0c|vaccine-free|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upgrade.queryservice.net (malware)"; content:"|07|upgrade|0c|queryservice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uploadmovie.cn (malware)"; content:"|0b|uploadmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usa-irs.com (phishing)"; content:"|07|usa-irs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usa-irs.net (phishing)"; content:"|07|usa-irs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaworldwideweb.ru (malware)"; content:"|0f|usaworldwideweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utube.co.il (zeus)"; content:"|05|utube|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vb.telecharger-gratuit.com (malware)"; content:"|02|vb|13|telecharger-gratuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videosmacons.t35.com (malware)"; content:"|0c|videosmacons|03|t35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vifiogod7com.net (zeus)"; content:"|0c|vifiogod7com|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusscaner.cn (malware)"; content:"|0b|virusscaner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkpriz.com (zeus)"; content:"|06|vkpriz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warbest.ru (malware)"; content:"|07|warbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdesktopnet.ru (malware)"; content:"|0d|webdesktopnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdirectbroker.ru (malware)"; content:"|0f|webdirectbroker|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weblessnet.ru (malware)"; content:"|0a|weblessnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnameg.com (zeus)"; content:"|08|webnameg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnetenglish.ru (malware)"; content:"|0d|webnetenglish|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnetlender.ru (malware)"; content:"|0c|webnetlender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnetloans.ru (malware)"; content:"|0b|webnetloans|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnicrisoft.net (malware)"; content:"|0c|webnicrisoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpetitesannonces.be (malware)"; content:"|12|webpetitesannonces|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wherei.in (malware)"; content:"|06|wherei|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup white-xxxx-tube.net (malware)"; content:"|0f|white-xxxx-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsouth.ru (malware)"; content:"|0a|worldsouth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldwebworld.ru (malware)"; content:"|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worthathousandwords.com (trojan)"; content:"|13|worthathousandwords|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wws.mobiec.net (malware)"; content:"|03|wws|06|mobiec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xboxliveweb.ru (malware)"; content:"|0b|xboxliveweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zly.hacked.jp (zeus)"; content:"|03|zly|06|hacked|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeshadowofyoursecurity.com (trojan)"; content:"|18|freeshadowofyoursecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodesecurity.com (trojan)"; content:"|0d|goodesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0891e.com.cn (trojan)"; content:"|05|0891e|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1vgtpp.eu (zbot)"; content:"|06|1vgtpp|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 53kkk1.info (trojan )"; content:"|06|53kkk1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 67pp.com (backdoor)"; content:"|04|67pp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abc-pl.com (malware)"; content:"|06|abc-pl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adbrite-com.1e100.net.petardas-com.carswebnet.ru (iframe)"; content:"|0b|adbrite-com|05|1e100|03|net|0c|petardas-com|0a|carswebnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adcounters.net (exploit )"; content:"|0a|adcounters|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adult-tube-free.com (trojan )"; content:"|0f|adult-tube-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adult-tube-free.net (trojan )"; content:"|0f|adult-tube-free|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agfasdasdf.freehostia.com (malware)"; content:"|0a|agfasdasdf|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazon-de.kinopoisk.ru.marketwatch-com.thechocolateweb.ru (iframe)"; content:"|09|amazon-de|09|kinopoisk|02|ru|0f|marketwatch-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analiticmondo.in (exploit )"; content:"|0d|analiticmondo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andige.net (zeus/wsnpoem)"; content:"|06|andige|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareonlinel1.com (rogue)"; content:"|13|antispywareonlinel1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atthisstage.com (exploit)"; content:"|0b|atthisstage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bild-de.zedge.net.qip-ru.thelaceweb.ru (iframe)"; content:"|07|bild-de|05|zedge|03|net|06|qip-ru|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizuklux.cn (zeus/wsnpoem)"; content:"|08|bizuklux|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackberry-com.indianrail.gov.in.aufeminin-com.thechocolateweb.ru (iframe)"; content:"|0e|blackberry-com|0a|indianrail|03|gov|02|in|0d|aufeminin-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boolred.in (exploit)"; content:"|07|boolred|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cgigfahccun.com (exploit )"; content:"|0b|cgigfahccun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pca1.com (rogue)"; content:"|0f|clean-your-pca1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pca2.com (rogue)"; content:"|0f|clean-your-pca2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcb1.com (rogue)"; content:"|0f|clean-your-pcb1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcb2.com (rogue)"; content:"|0f|clean-your-pcb2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcc1.com (rogue)"; content:"|0f|clean-your-pcc1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcd1.com (rogue)"; content:"|0f|clean-your-pcd1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcd2.com (rogue)"; content:"|0f|clean-your-pcd2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pce2.com (rogue)"; content:"|0f|clean-your-pce2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-your-pcr1.com (rogue)"; content:"|0f|clean-your-pcr1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clicksor-com.eastmoney.com.mobile-de.homesaleplus.ru (iframe)"; content:"|0c|clicksor-com|09|eastmoney|03|com|09|mobile-de|0c|homesaleplus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnzz-com.play.com.detik-com.thechocolateweb.ru (iframe)"; content:"|08|cnzz-com|04|play|03|com|09|detik-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confeop.com (zbot)"; content:"|07|confeop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deadlockedpics.com (rogue)"; content:"|0e|deadlockedpics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dell-com.xanga.com.bild-de.worldwebworld.ru (iframe)"; content:"|08|dell-com|05|xanga|03|com|07|bild-de|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dict-cc.plentyoffish.com.way2sms-com.webdesktopnet.ru (iframe)"; content:"|07|dict-cc|0c|plentyoffish|03|com|0b|way2sms-com|0d|webdesktopnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverany.cn (zeus/wsnpoem)"; content:"|0b|discoverany|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctissimo-fr.news.com.au.accuweather-com.worldwebworld.ru (iframe)"; content:"|0d|doctissimo-fr|04|news|03|com|02|au|0f|accuweather-com|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-free-files.com (trojan )"; content:"|13|download-free-files|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-free-files.net (trojan )"; content:"|13|download-free-files|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eicyxtaecun.com (exploit )"; content:"|0b|eicyxtaecun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eliteproctologyforyourass.biz (exploit)"; content:"|19|eliteproctologyforyourass|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elmundo-es.gazzetta.it.careerbuilder-com.funwebmail.ru (iframe)"; content:"|0a|elmundo-es|08|gazzetta|02|it|11|careerbuilder-com|0a|funwebmail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elnasa.ru (zeus/wsnpoem)"; content:"|06|elnasa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup empflix-com.nfl.com.filefactory-com.carswebnet.ru (iframe)"; content:"|0b|empflix-com|03|nfl|03|com|0f|filefactory-com|0a|carswebnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engadget-com.adult-empire.com.chinaz-com.worldwebworld.ru (iframe)"; content:"|0c|engadget-com|0c|adult-empire|03|com|0a|chinaz-com|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enlightenedver.com (rogue)"; content:"|0e|enlightenedver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyspysoftwarepill.com (trojan )"; content:"|17|freeantyspysoftwarepill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyviruspillonline.com (trojan )"; content:"|17|freeantyviruspillonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyviruspills.com (trojan )"; content:"|12|freeantyviruspills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyviruspillsite.com (trojan )"; content:"|15|freeantyviruspillsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantyviruspillstore.com (trojan )"; content:"|16|freeantyviruspillstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-counter.com (exploit)"; content:"|0e|google-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatpeopleoftheworld.com (zeus/wsnpoem)"; content:"|15|greatpeopleoftheworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guidebat.ru (malware)"; content:"|08|guidebat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwsdwxae.cn (malware)"; content:"|08|gwsdwxae|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup healing-tao.pl (harmful)"; content:"|0b|healing-tao|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoopchina-com.it168.com.drudgereport-com.thechocolateweb.ru (iframe)"; content:"|0d|hoopchina-com|05|it168|03|com|10|drudgereport-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup host127-0-0-1.com (malware)"; content:"|0d|host127-0-0-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibm-com.lowes.com.wowarmory-com.worldwebworld.ru (iframe)"; content:"|07|ibm-com|05|lowes|03|com|0d|wowarmory-com|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iciba-com.orbitz.com.mainichi-jp.worldwebworld.ru (iframe)"; content:"|09|iciba-com|06|orbitz|03|com|0b|mainichi-jp|0d|worldwebworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icio-us.google.ro.musica-com.thelaceweb.ru (iframe)"; content:"|07|icio-us|06|google|02|ro|0a|musica-com|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijgfshjuno.net (malware)"; content:"|0a|ijgfshjuno|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-antivir11.com (trojan )"; content:"|0e|inet-antivir11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-antivir12.com (trojan )"; content:"|0e|inet-antivir12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-antivir21.com (trojan )"; content:"|0e|inet-antivir21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-antivir22.com (trojan )"; content:"|0e|inet-antivir22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-antivir26.com (trojan )"; content:"|0e|inet-antivir26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivir022.com (rogue)"; content:"|13|internet-antivir022|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivir033.com (rogue)"; content:"|13|internet-antivir033|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivir044.com (rogue)"; content:"|13|internet-antivir044|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-guard.net (rogue)"; content:"|0e|internet-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup introstep.biz (exploit)"; content:"|09|introstep|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irctc-co-in.rapidshare.com.skyrock-com.thechocolateweb.ru (iframe)"; content:"|0b|irctc-co-in|0a|rapidshare|03|com|0b|skyrock-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ishndor.org (zeus/wsnpoem)"; content:"|07|ishndor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwantr8.ru (zeus)"; content:"|07|iwantr8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jk35css.cn (zeus/wsnpoem)"; content:"|07|jk35css|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnsite.ru (malware)"; content:"|08|johnsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-spywarem2.com (rogue)"; content:"|0e|kill-spywarem2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-spywarem7.com (rogue)"; content:"|0e|kill-spywarem7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kit.mastacash.com (malware)"; content:"|03|kit|09|mastacash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kizliar1.com (zeus/wsnpoem)"; content:"|08|kizliar1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kukusiki.com (exploit)"; content:"|08|kukusiki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lagworld.ru (malware)"; content:"|08|lagworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastcodone.com (malware)"; content:"|0a|lastcodone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastping.com (malware)"; content:"|08|lastping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linezing-com.thepiratebay.org.gazeta-pl.thechocolateweb.ru (iframe)"; content:"|0c|linezing-com|0c|thepiratebay|03|org|09|gazeta-pl|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lucknets.com (zbot)"; content:"|08|lucknets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mail-ru.gamefaqs.com.aweber-com.thechocolateweb.ru (iframe)"; content:"|07|mail-ru|08|gamefaqs|03|com|0a|aweber-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manbest.ru (malware)"; content:"|07|manbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mettgroup.com (zeus)"; content:"|09|mettgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mezdunar3net.com (zeus)"; content:"|0c|mezdunar3net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mihanblog-com.google.ae.google-gr.thechocolateweb.ru (iframe)"; content:"|0d|mihanblog-com|06|google|02|ae|09|google-gr|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miniclip-com.t-mobile.com.yourfilehost-com.thechocolateweb.ru (iframe)"; content:"|0c|miniclip-com|08|t-mobile|03|com|10|yourfilehost-com|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobile-an-ty-spyware-pill.com (trojan )"; content:"|19|mobile-an-ty-spyware-pill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieinfobank.com (rogue)"; content:"|0d|movieinfobank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtv-com.citibank.com.gutefrage-net.webdesktopnet.ru (iframe)"; content:"|07|mtv-com|08|citibank|03|com|0d|gutefrage-net|0d|webdesktopnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydailymail.cn (malware)"; content:"|0b|mydailymail|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfreeantyviruspill.com (trojan )"; content:"|13|myfreeantyviruspill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecretinfo.com (zeus/wsnpoem)"; content:"|0c|mysecretinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newfreeantyviruspill.com (trojan )"; content:"|14|newfreeantyviruspill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextpics.org (zeus)"; content:"|08|nextpics|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikkei-co-jp.gamefaqs.com.clickbank-com.carswebnet.ru (iframe)"; content:"|0c|nikkei-co-jp|08|gamefaqs|03|com|0d|clickbank-com|0a|carswebnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nowdownloadall-com.costco.com.travelocity-com.thelaceweb.ru (iframe)"; content:"|12|nowdownloadall-com|06|costco|03|com|0f|travelocity-com|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohyeah213.com (zeus)"; content:"|09|ohyeah213|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ok87ii.ne.kr (fastflux)"; content:"|06|ok87ii|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuo.ne.kr (fastflux)"; content:"|07|oki8uuo|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuq.co.kr (fastflux)"; content:"|07|oki8uuq|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuq.kr (fastflux)"; content:"|07|oki8uuq|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuq.or.kr (fastflux)"; content:"|07|oki8uuq|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuu.co.kr (fastflux)"; content:"|07|oki8uuu|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuu.kr (fastflux)"; content:"|07|oki8uuu|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuu.ne.kr (fastflux)"; content:"|07|oki8uuu|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuu.or.kr (fastflux)"; content:"|07|oki8uuu|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oki8uuw.kr (fastflux)"; content:"|07|oki8uuw|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyi1.com (rogue)"; content:"|10|online-antispyi1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyi2.com (rogue)"; content:"|10|online-antispyi2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyi5.com (rogue)"; content:"|10|online-antispyi5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispym1.com (rogue)"; content:"|10|online-antispym1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-scanl8.com (rogue)"; content:"|15|online-spyware-scanl8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantispywareremo.com (rogue)"; content:"|15|onlineantispywareremo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineantivirusr4.com (rogue)"; content:"|11|onlineantivirusr4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup open-an-ty-spyware-pill.com (trojan )"; content:"|17|open-an-ty-spyware-pill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup overstock-com.gamefaqs.com.nu-nl.thechocolateweb.ru (iframe)"; content:"|0d|overstock-com|08|gamefaqs|03|com|05|nu-nl|0f|thechocolateweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pantherpicso.com (rouge)"; content:"|0c|pantherpicso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pilonoc.cn (zeus)"; content:"|07|pilonoc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornbb-org.sourceforge.net.ime-nu.halfsite.ru (iframe)"; content:"|0a|pornbb-org|0b|sourceforge|03|net|06|ime-nu|08|halfsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozeml.com (malware)"; content:"|06|pozeml|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup progressiveol.org (zeus)"; content:"|0d|progressiveol|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcfhgajqcun.com (exploit )"; content:"|0b|qcfhgajqcun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quartertin.info (exploit)"; content:"|0a|quartertin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radikal-ru.nydailynews.com.tianya-cn.greatwebradio.ru (iframe)"; content:"|0a|radikal-ru|0b|nydailynews|03|com|09|tianya-cn|0d|greatwebradio|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rainerfox.narod.ru (zeus)"; content:"|09|rainerfox|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup razved.org (exploit)"; content:"|06|razved|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexyshowvideo.info (trojan )"; content:"|0d|sexyshowvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shells4you.net (malware)"; content:"|0a|shells4you|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shinobi-jp.excite.co.jp.nfl-com.thelaceweb.ru (iframe)"; content:"|0a|shinobi-jp|06|excite|02|co|02|jp|07|nfl-com|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softlayer-com.capitalone.com.google-co-th.viewhomesale.ru (iframe)"; content:"|0d|softlayer-com|0a|capitalone|03|com|0c|google-co-th|0c|viewhomesale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soprocms.com (exploit)"; content:"|08|soprocms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sponsorads-de.58.com.abc-go-com.thelaceweb.ru (iframe)"; content:"|0d|sponsorads-de|02|58|03|com|0a|abc-go-com|0a|thelaceweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-scanneri07.com (rogue)"; content:"|0e|spy-scanneri07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-remover071.com (rogue)"; content:"|12|spyware-remover071|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallvars-1.com (exploit)"; content:"|0b|stallvars-1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stc-com-sa.chip.de.badoo-com.viewhomesale.ru (iframe)"; content:"|0a|stc-com-sa|04|chip|02|de|09|badoo-com|0c|viewhomesale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-virus-4.com (trojan )"; content:"|0c|stop-virus-4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-virus-6.com (trojan )"; content:"|0c|stop-virus-6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopspaming.com (zeus/wsnpoem)"; content:"|0b|stopspaming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunshinesrose.com (exploit)"; content:"|0d|sunshinesrose|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supergh0st.in (zbot)"; content:"|0a|supergh0st|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysdefenders.com (rogue)"; content:"|0c|sysdefenders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telkiiporno.ru (trojan )"; content:"|0b|telkiiporno|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempoktv.com.tw (trojan )"; content:"|08|tempoktv|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testing3.fileave.com (malware)"; content:"|08|testing3|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tg.01lm.com (malicious)"; content:"|02|tg|04|01lm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefreeantyviruspill.com (trojan )"; content:"|14|thefreeantyviruspill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themobisite.ru (malware)"; content:"|0b|themobisite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetraf.net (rogue)"; content:"|07|thetraf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewarriorgroup.com (trojan )"; content:"|0f|thewarriorgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojan-scanner01.com (rogue)"; content:"|10|trojan-scanner01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojanscan04.com (rogue)"; content:"|0c|trojanscan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trojanscan08.com (rogue)"; content:"|0c|trojanscan08|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujjiks.im (zbot)"; content:"|06|ujjiks|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup undershotpics.com (rogue)"; content:"|0d|undershotpics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup us.kyod.biz (zeus/wsnpoem)"; content:"|02|us|04|kyod|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usfiles.brothersoft.com (trojan )"; content:"|07|usfiles|0b|brothersoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usuarios.arnet.com.ar (trojan )"; content:"|08|usuarios|05|arnet|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbftppp2.co.uk (zbot)"; content:"|08|vbftppp2|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbftppp3.co.uk (zbot)"; content:"|08|vbftppp3|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbftppp4.co.uk (nzbot)"; content:"|08|vbftppp4|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcsltp.com (zbot)"; content:"|06|vcsltp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdflpttt.co.uk (zbot)"; content:"|09|vsdflpttt|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsdflpttt.com (zbot)"; content:"|09|vsdflpttt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webvirusscanner33.com (rogue)"; content:"|11|webvirusscanner33|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup who-let-block.com (fastflux)"; content:"|0d|who-let-block|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zmmoscow.com (exploit)"; content:"|08|zmmoscow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowestmarriott.com (exploits )"; content:"|0e|gowestmarriott|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatesecurityshop.com (trojan)"; content:"|12|greatesecurityshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 04aa44713f.net (malware)"; content:"|0a|04aa44713f|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 07073.com (harmful)"; content:"|05|07073|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12aszh.com.pl (fastflux)"; content:"|06|12aszh|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12aszk.com.pl (fastflux)"; content:"|06|12aszk|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12aszl.com.pl (fastflux)"; content:"|06|12aszl|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 15556.net (malware)"; content:"|05|15556|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ac09b9715.net (malware)"; content:"|0a|1ac09b9715|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1bfc5c8aac.net (malware)"; content:"|0a|1bfc5c8aac|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 21npc.com (exploit)"; content:"|05|21npc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 21sys21.cn (malware)"; content:"|07|21sys21|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 22sys22.cn (malware)"; content:"|07|22sys22|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 23sys23.cn (malware)"; content:"|07|23sys23|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 26484764bd.net (malware)"; content:"|0a|26484764bd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2ee91680f2.net (malware)"; content:"|0a|2ee91680f2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33pingvina-chita.ru (zeus)"; content:"|10|33pingvina-chita|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 48b5bb6b73.net (malware)"; content:"|0a|48b5bb6b73|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4analytics.ws (exploit)"; content:"|0a|4analytics|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4fcb08ef77.net (malware)"; content:"|0a|4fcb08ef77|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5d6f85739f.net (malware)"; content:"|0a|5d6f85739f|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 60sys60.cn (malware)"; content:"|07|60sys60|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 66xb.com (malware)"; content:"|04|66xb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6a1003a634.net (malware)"; content:"|0a|6a1003a634|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6ded52ce69.net (malware)"; content:"|0a|6ded52ce69|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 760d4f9975.net (malware)"; content:"|0a|760d4f9975|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8800.org (malware)"; content:"|04|8800|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8866.org (malware)"; content:"|04|8866|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 97it.com.cn (malware)"; content:"|04|97it|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9ix.ru (malware)"; content:"|03|9ix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aarohan.kecua.in (exploit)"; content:"|07|aarohan|05|kecua|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdelmohsen.org (malware)"; content:"|0b|abdelmohsen|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe6-athun.cn (zeus)"; content:"|0c|adobe6-athun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobeflahsplayer.mail333.su (malware)"; content:"|10|adobeflahsplayer|07|mail333|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al-soft.com (malware)"; content:"|07|al-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al25.com (zeus)"; content:"|04|al25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amyslittleworld.com (Trojan )"; content:"|0f|amyslittleworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androzo.ru (zeus)"; content:"|07|androzo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarel7.com (rogue)"; content:"|0d|antispywarel7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareonlinel8.com (rogue)"; content:"|13|antispywareonlinel8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live.com (scareware)"; content:"|0e|antivirus-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus360.ru (rogue)"; content:"|0c|antivirus360|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apartamencik69.pl (exploit)"; content:"|0e|apartamencik69|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apcdefender.com (threat)"; content:"|0b|apcdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arbsecret.com (Trojan )"; content:"|09|arbsecret|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arntool.com (malware)"; content:"|07|arntool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8997e2123.net (malware)"; content:"|0a|b8997e2123|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bablodos.com (malware)"; content:"|08|bablodos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babooa562.com (exploit)"; content:"|09|babooa562|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup back-shure.ru (scareware)"; content:"|0a|back-shure|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baiducom.net.cn (malware)"; content:"|08|baiducom|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bc7560e69a.net (malware)"; content:"|0a|bc7560e69a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdcnm.cn (malware)"; content:"|05|bdcnm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bespokeinframe.co.uk (exploit)"; content:"|0e|bespokeinframe|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgooogffh33.info (zeus)"; content:"|0e|bestgooogffh33|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigfatisp.com (malware)"; content:"|09|bigfatisp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biglard.com (malware)"; content:"|07|biglard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bistrium.si (zbot)"; content:"|08|bistrium|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blinvishka.in (zeus)"; content:"|0a|blinvishka|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blueartsstudio.com (trojan)"; content:"|0e|blueartsstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluemuntaincard.com (malspam)"; content:"|0f|bluemuntaincard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodegazonen.dk (zeus)"; content:"|0b|bodegazonen|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodyscanfit.com (harmful)"; content:"|0b|bodyscanfit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brauen.de (exploit)"; content:"|06|brauen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bublik.feshost.ru (zbot)"; content:"|06|bublik|07|feshost|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businesscosult4u.com (zeus)"; content:"|10|businesscosult4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7cf793d83.net (malware)"; content:"|0a|c7cf793d83|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkvirus.net (zeus)"; content:"|0a|checkvirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooltube4u.com (Trojan )"; content:"|0a|cooltube4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cvn.org.br (malware)"; content:"|03|cvn|03|org|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxsar.info (malware)"; content:"|05|cxsar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dancerte.in (zeus)"; content:"|08|dancerte|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dengyan520.com (malware)"; content:"|0a|dengyan520|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devsshop.info (malware)"; content:"|08|devsshop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlinktransfer.cn (malware)"; content:"|0d|dlinktransfer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docxmad.com (botnet)"; content:"|07|docxmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogmasoftware.org (rogue)"; content:"|0d|dogmasoftware|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolbanov.net (zeus)"; content:"|08|dolbanov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dollardream.ru (threat)"; content:"|0b|dollardream|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dollymultimedia.com (trojan)"; content:"|0f|dollymultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup driver-cs.real-host.ru (zeus)"; content:"|09|driver-cs|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup droppingout.cn (Trojan )"; content:"|0b|droppingout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eagleznet.com (exploit)"; content:"|09|eagleznet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sa0.com.pl (fastflux)"; content:"|07|eee1sa0|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sa4.com.pl (fastflux)"; content:"|07|eee1sa4|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sa9.com.pl (fastflux)"; content:"|07|eee1sa9|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sae.com.pl (fastflux)"; content:"|07|eee1sae|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sar.com.pl (fastflux)"; content:"|07|eee1sar|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eee1sat.com.pl (fastflux)"; content:"|07|eee1sat|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evanpublishing.com (Trojan )"; content:"|0e|evanpublishing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabrugs.com (exploit)"; content:"|07|fabrugs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feidingding.com (malware)"; content:"|0b|feidingding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenghuashi.com (malware)"; content:"|0a|fenghuashi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffxidown.com (malware)"; content:"|08|ffxidown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findlots.org (Trojan )"; content:"|08|findlots|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitme.jp (exploit)"; content:"|05|fitme|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotologaso.miss-web.es (zbot)"; content:"|0a|fotologaso|08|miss-web|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsus.cn (exploit)"; content:"|04|fsus|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftp2.homeunix.com (exploit)"; content:"|04|ftp2|08|homeunix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funtixfreak.com (Trojan )"; content:"|0b|funtixfreak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futurama4u.com (zeus)"; content:"|0a|futurama4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidroanalizer.cn (zbot)"; content:"|0d|gidroanalizer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenstarevents.net (exploit)"; content:"|10|goldenstarevents|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google--analytics.com (malicious)"; content:"|11|google--analytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-anallytics.com (malicious)"; content:"|11|google-anallytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analyitics.com (malicious)"; content:"|11|google-analyitics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytiics.com (malware)"; content:"|11|google-analytiics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-anolytics.com (malicious)"; content:"|10|google-anolytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlesyndications.co.cc (risk)"; content:"|12|googlesyndications|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gova.0891e.com.cn (Trojan )"; content:"|04|gova|05|0891e|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatesecuritytoday.com (trojan)"; content:"|13|greatesecuritytoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grundschule1.zirndorf.de (exploit)"; content:"|0c|grundschule1|08|zirndorf|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hanadoki.info (exploit)"; content:"|08|hanadoki|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homelinux.org (exploit)"; content:"|09|homelinux|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeunix.com (exploit)"; content:"|08|homeunix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostanalytics.bissnes.net (zeus)"; content:"|0d|hostanalytics|07|bissnes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotdot2561.com (zeus)"; content:"|0a|hotdot2561|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikhanflkarian.limewebs.com (zeus)"; content:"|0d|ikhanflkarian|08|limewebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indexparty.info (zeus)"; content:"|0a|indexparty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet6scanner.com (malware)"; content:"|0c|inet6scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-scanner41.com (malware)"; content:"|12|internet-scanner41|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itsupportworld.com (zeus)"; content:"|0e|itsupportworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup journalweb.org (Trojan )"; content:"|0a|journalweb|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jtfonline.com (Trojan )"; content:"|09|jtfonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicypalace.com (malware)"; content:"|0b|juicypalace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julia777.cn (zeus)"; content:"|08|julia777|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfgrtjer.cn (malware)"; content:"|08|kfgrtjer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup li107-40.members.linode.com (exploit)"; content:"|08|li107-40|07|members|06|linode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locateyourlove.info (zeus)"; content:"|0e|locateyourlove|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logssearch.info (zbot)"; content:"|0a|logssearch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lol100.100webspace.net (zeus)"; content:"|06|lol100|0b|100webspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovebluecard.com (malspam)"; content:"|0c|lovebluecard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mag.100webspace.net (zeus)"; content:"|03|mag|0b|100webspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matrix007.com (zeus)"; content:"|09|matrix007|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaonlinebank.com (trojan)"; content:"|0f|mediaonlinebank|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mercuryepm.com (zeus)"; content:"|0a|mercuryepm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metin2-handel.pl (Trojan )"; content:"|0d|metin2-handel|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mgtlsoft.in (Trojan )"; content:"|08|mgtlsoft|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minemane.info (zbot)"; content:"|08|minemane|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missatlantico.com.uy (exploit)"; content:"|0d|missatlantico|03|com|02|uy"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mm2-antivirus.com (malware)"; content:"|0d|mm2-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momeyz.com (Trojan )"; content:"|06|momeyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ms8.cc (exploit)"; content:"|03|ms8|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muchomucho.net (zeus)"; content:"|0a|muchomucho|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediatechinc.com (trojan)"; content:"|11|multimediatechinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydressroom.co.kr (risk)"; content:"|0b|mydressroom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup napznet.me (zbot)"; content:"|07|napznet|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazionalepugilifootball.com (zeus)"; content:"|17|nazionalepugilifootball|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nba1001.net (exploit)"; content:"|07|nba1001|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbclick.net (zeus)"; content:"|07|nbclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ndevelop.org (zeus)"; content:"|08|ndevelop|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsneg.ru (scareware)"; content:"|07|newsneg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup night-up.ru (scareware)"; content:"|08|night-up|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nightup.ru (scareware)"; content:"|07|nightup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nokia-6303.nl (exploit)"; content:"|0a|nokia-6303|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nokiamoon.com (zeus)"; content:"|09|nokiamoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nomalwarelab.com (scareware)"; content:"|0c|nomalwarelab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nomalwares.org (scareware)"; content:"|0a|nomalwares|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiuyrw.biz (zeus)"; content:"|06|oiuyrw|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyl1.com (scareware)"; content:"|10|online-antispyl1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispyl5.com (scareware)"; content:"|10|online-antispyl5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispym3.com (scareware)"; content:"|10|online-antispym3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-antispym5.com (scareware)"; content:"|10|online-antispym5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-spyware-killl8.com (scareware)"; content:"|15|online-spyware-killl8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ontogen.com (scareware)"; content:"|07|ontogen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourhobby.com (exploit)"; content:"|08|ourhobby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pelikanzslatd.com (zeus)"; content:"|0d|pelikanzslatd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photoarana.com (exploit)"; content:"|0a|photoarana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piramidsoftware.info (Trojan )"; content:"|0f|piramidsoftware|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pobedim.cn (zeus)"; content:"|07|pobedim|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ponti30.com (zeus)"; content:"|07|ponti30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-pca1.com (scareware)"; content:"|0c|protect-pca1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-pcr1.com (malware)"; content:"|0c|protect-pcr1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-pct1.com (malware)"; content:"|0c|protect-pct1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-pcu1.com (malware)"; content:"|0c|protect-pcu1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectxyour.com (rogue)"; content:"|0c|protectxyour|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qizhouhuinong.com (risk)"; content:"|0d|qizhouhuinong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlzwg.com (risk)"; content:"|05|qlzwg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq66.in (harmful)"; content:"|04|qq66|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quadpaymentsystem.com (malware)"; content:"|11|quadpaymentsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvodcom1.com (attack_site)"; content:"|08|qvodcom1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmultimediaonline.com (trojan)"; content:"|14|realmultimediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtybestus.com (zeus)"; content:"|0c|realtybestus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remove-threatsl2.com (malware)"; content:"|10|remove-threatsl2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-your-pc004.com (malware)"; content:"|0f|safe-your-pc004|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup say-yes.biz (malware)"; content:"|07|say-yes|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-computerab.com (malware)"; content:"|0f|scan-computerab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanersorry.cn (rogue)"; content:"|0b|scanersorry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-on-line02.com (malware)"; content:"|11|scanner-on-line02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-on-line03.com (malware)"; content:"|11|scanner-on-line03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerpc-2012.info (Trojan )"; content:"|0e|scannerpc-2012|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scannerspy02.com (malware)"; content:"|0c|scannerspy02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchhenry.org (Trojan )"; content:"|0b|searchhenry|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.valid.cc (zeus)"; content:"|06|secure|05|valid|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwareo5.com (malware)"; content:"|13|security-softwareo5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwareo7.com (malware)"; content:"|13|security-softwareo7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwareo9.com (malware)"; content:"|13|security-softwareo9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security360update.com (rogue)"; content:"|11|security360update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitycenter1.com (malware)"; content:"|0f|securitycenter1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftware1.com (malware)"; content:"|11|securitysoftware1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftware3.com (malware)"; content:"|11|securitysoftware3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftware5.com (malware)"; content:"|11|securitysoftware5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftwaree.com (malware)"; content:"|11|securitysoftwaree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysoftwaree7.com (malware)"; content:"|12|securitysoftwaree7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop.prociechi.it (zeus)"; content:"|04|shop|09|prociechi|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snegyear.ru (scareware)"; content:"|08|snegyear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software2008.net (rogue)"; content:"|0c|software2008|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software2009.net (rogue)"; content:"|0c|software2009|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarealarm.net (rogue)"; content:"|0d|softwarealarm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareanti.com (rogue)"; content:"|0c|softwareanti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareanti.net (rogue)"; content:"|0c|softwareanti|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaredefense.net (rogue)"; content:"|0f|softwaredefense|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaregateway.net (rogue)"; content:"|0f|softwaregateway|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarejar.com (rogue)"; content:"|0b|softwarejar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarejar.net (rogue)"; content:"|0b|softwarejar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwareranking.net (rogue)"; content:"|0f|softwareranking|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarerising.com (rogue)"; content:"|0e|softwarerising|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarerising.net (rogue)"; content:"|0e|softwarerising|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarescanner.net (rogue)"; content:"|0f|softwarescanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaresecure.net (rogue)"; content:"|0e|softwaresecure|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarespam.net (rogue)"; content:"|0c|softwarespam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarespyware.net (rogue)"; content:"|0f|softwarespyware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarethe.net (rogue)"; content:"|0b|softwarethe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarethreats.com (rogue)"; content:"|0f|softwarethreats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarethreats.net (rogue)"; content:"|0f|softwarethreats|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarexp.net (rogue)"; content:"|0a|softwarexp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sojogosfotos.com (Trojan )"; content:"|0c|sojogosfotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-remove92.com (malware)"; content:"|10|spyware-remove92|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sruprekut.net (zeus)"; content:"|09|sruprekut|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superartsstudio.com (trojan)"; content:"|0f|superartsstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svinopavstvo.cn (zeus)"; content:"|0c|svinopavstvo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemy-grzewcze.net (exploit)"; content:"|10|systemy-grzewcze|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thescanonline.info (malware)"; content:"|0d|thescanonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thrownout.cn (Trojan )"; content:"|09|thrownout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tidworld.no (exploit)"; content:"|08|tidworld|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustservice.in (zeus)"; content:"|0c|trustservice|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tsqzsb.cn (attack_site)"; content:"|06|tsqzsb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube5000-free.info (Trojan )"; content:"|0d|tube5000-free|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unseenproductions.com (TrojanSpy)"; content:"|11|unseenproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vazegdurak.cn (zeus)"; content:"|0a|vazegdurak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visatour.asia (zeus)"; content:"|08|visatour|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vodkalv.com (Trojan )"; content:"|07|vodkalv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup votedout.cn (Trojan )"; content:"|08|votedout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbdica.com (attack_site)"; content:"|06|wbdica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-scan006.com (malware)"; content:"|0b|web-scan006|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-virus-scanner1.com (malware)"; content:"|12|web-virus-scanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-virus-scanner11.com (malware)"; content:"|13|web-virus-scanner11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webreed.org (Trojan )"; content:"|07|webreed|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webvirusscanner22.com (malware)"; content:"|11|webvirusscanner22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-update.cn (zbot)"; content:"|0e|windows-update|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-update2020.com (zeus)"; content:"|12|windows-update2020|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsdown.com.cn (attack_site)"; content:"|08|winsdown|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsecurity12.com (malware)"; content:"|0d|winsecurity12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsdcf2009.org (attack_site)"; content:"|09|wsdcf2009|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xingan5.cn (harmful)"; content:"|07|xingan5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmas-carols2.com (malware)"; content:"|0c|xmas-carols2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoomailcenter.ru (fastflux)"; content:"|0f|yahoomailcenter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandexcars.cn (exploit)"; content:"|0a|yandexcars|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup year-sneg.ru (scareware)"; content:"|09|year-sneg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yearsneg.ru (scareware)"; content:"|08|yearsneg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmultimediagroup.com (trojan)"; content:"|13|yourmultimediagroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeuxmad.com (zeus)"; content:"|07|zeuxmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatesupport.com (trojan)"; content:"|0d|greatesupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1188c.com (threat)"; content:"|05|1188c|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 34218.cn (trojan )"; content:"|05|34218|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51backup.cn (trojan )"; content:"|08|51backup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 58bbx.net.cn (trojan )"; content:"|05|58bbx|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abasonic-ig.de (zbot)"; content:"|0b|abasonic-ig|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancededgeins.com (exploits )"; content:"|0f|advancededgeins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amx367.com (trojan )"; content:"|06|amx367|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availname.net (zeus)"; content:"|09|availname|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biteuro.com (malware)"; content:"|07|biteuro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certljzigo.com (trojan )"; content:"|0a|certljzigo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfagzbnyzx.com (trojan )"; content:"|0a|cfagzbnyzx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfpjjcjvujsg.com (trojan )"; content:"|0c|cfpjjcjvujsg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cghokaqugr.com (trojan )"; content:"|0a|cghokaqugr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conikor.com (exploit)"; content:"|07|conikor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dafaroff.freehostia.com (zbot)"; content:"|08|dafaroff|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbtgkayczo.com (trojan )"; content:"|0a|dbtgkayczo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendapc.com (rogue)"; content:"|09|defendapc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dekdovbrnu.com (trojan )"; content:"|0a|dekdovbrnu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfahjjijqn.com (trojan )"; content:"|0a|dfahjjijqn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgfhztllhm.com (trojan )"; content:"|0a|dgfhztllhm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsserverbackupzones.com (zbot)"; content:"|14|dnsserverbackupzones|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dofvs.com (trojan)"; content:"|05|dofvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domnwiit.in (trojan )"; content:"|08|domnwiit|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doubleclickredir.com (rogue)"; content:"|10|doubleclickredir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electrofunny.cn (exploits )"; content:"|0c|electrofunny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgihijmuno.com (trojan )"; content:"|0a|fgihijmuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files.calvarybucyrus.org (hacktool )"; content:"|05|files|0e|calvarybucyrus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghedlfvuno.com (trojan )"; content:"|0a|ghedlfvuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghost-antivirus.com (rogue)"; content:"|0f|ghost-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghost-pay.com (rogue)"; content:"|09|ghost-pay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghostantivirus.com (rogue)"; content:"|0e|ghostantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghostpays.com (rogue)"; content:"|09|ghostpays|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghtsxuguno.com (trojan )"; content:"|0a|ghtsxuguno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlefastanalytics.eu (zbot)"; content:"|13|googlefastanalytics|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenlpl.com (exploits )"; content:"|08|greenlpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gspotxtreme.com.au (zeus)"; content:"|0b|gspotxtreme|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjgfw34rwedfgds.com (malware)"; content:"|0f|hjgfw34rwedfgds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostingdnssite.com (zbot)"; content:"|0e|hostingdnssite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostwebdns.com (malware)"; content:"|0a|hostwebdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internazionale.vc (zbot)"; content:"|0e|internazionale|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internethostingdns.com (malware)"; content:"|12|internethostingdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpjigol.cn (bot)"; content:"|07|jpjigol|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkeeoopp.info (trojan )"; content:"|08|kkeeoopp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klrs.onlinedown.net (trojan )"; content:"|04|klrs|0a|onlinedown|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopuna.com (zeus)"; content:"|06|kopuna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krolingermn.cn (zbot)"; content:"|0b|krolingermn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kvantvertop.com (zeus)"; content:"|0b|kvantvertop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leeds-consulting.com (zeus)"; content:"|10|leeds-consulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lizingss.com (exploits )"; content:"|08|lizingss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luboydomen.cn (c&c)"; content:"|0a|luboydomen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m19citizen.cn (exploits )"; content:"|0a|m19citizen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media.orgypix.com (trojan )"; content:"|05|media|07|orgypix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morsayniketamere.cn (zeus)"; content:"|10|morsayniketamere|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviemusicuk.us (koobface)"; content:"|0c|moviemusicuk|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutwa.info (exploits )"; content:"|05|mutwa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutwc.info (exploits )"; content:"|05|mutwc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutwe.info (exploits )"; content:"|05|mutwe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nfgnmxonuno.com (trojan )"; content:"|0b|nfgnmxonuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oijeaxx.com.pl (fastflux)"; content:"|07|oijeaxx|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oijhaxx.com.pl (fastflux)"; content:"|07|oijhaxx|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oijqayx.com.pl (fastflux)"; content:"|07|oijqayx|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiybkqr.com.pl (fastflux)"; content:"|07|oiybkqr|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiyqayr.com.pl (fastflux)"; content:"|07|oiyqayr|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiyqayx.com.pl (fastflux)"; content:"|07|oiyqayx|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onybmsm.com.pl (fastflux)"; content:"|07|onybmsm|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oxefyde.info (trojan )"; content:"|07|oxefyde|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oye777.com (trojan )"; content:"|06|oye777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdsproperties.net (zeus)"; content:"|0d|pdsproperties|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pikie.com.pl (exploits )"; content:"|05|pikie|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pikoe.com.pl (exploits )"; content:"|05|pikoe|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pikqe.com.pl (exploits )"; content:"|05|pikqe|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pikye.com.pl (exploits )"; content:"|05|pikye|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pilawyer.com (exploits )"; content:"|08|pilawyer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pioqe.com.pl (exploits )"; content:"|05|pioqe|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pioqo.com.pl (exploits )"; content:"|05|pioqo|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinumhostingservice.com (zbot)"; content:"|16|platinumhostingservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platpro-db.net (zeus)"; content:"|0a|platpro-db|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerdatamedia.com (phish)"; content:"|0e|powerdatamedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pumpidss.com (exploits )"; content:"|08|pumpidss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qaqaqaqa.net (trojan)"; content:"|08|qaqaqaqa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicksitehostdns.com (malware)"; content:"|10|quicksitehostdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwzxase.co.uk (phishing)"; content:"|07|qwzxase|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwzxase.ws (phishing)"; content:"|07|qwzxase|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbkqd.info (exploits )"; content:"|05|sbkqd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servingmydns.com (malware)"; content:"|0c|servingmydns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorbauto.com (zeus)"; content:"|08|sorbauto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersmsshpion.com (trojan)"; content:"|0e|supersmsshpion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-resolve.com (c&c)"; content:"|0e|system-resolve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testbrazer.com (exploit)"; content:"|0a|testbrazer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfgsrdttuno.com (trojan )"; content:"|0b|tfgsrdttuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theauthorizer.com (rogue)"; content:"|0d|theauthorizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesecurebill.com (fraud)"; content:"|0d|thesecurebill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesoftbill.com (fraud)"; content:"|0b|thesoftbill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup to-scanyourpcnow.com (threat)"; content:"|10|to-scanyourpcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transfreg.net (zeus)"; content:"|09|transfreg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treverthis.com (zeus)"; content:"|0a|treverthis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treverthisone.com (zeus)"; content:"|0d|treverthisone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tttbbbttt.zapto.org (zbot)"; content:"|09|tttbbbttt|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tweety.sk (trojan )"; content:"|06|tweety|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vod.hhsese.com (malware)"; content:"|03|vod|06|hhsese|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whatismyipinfo.net (zeus)"; content:"|0e|whatismyipinfo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsserverinfo.com (zbot)"; content:"|11|windowsserverinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xakepbox.narod.ru (trojan)"; content:"|08|xakepbox|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhnki6u.com.pl (fastflux)"; content:"|07|yhnki6u|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhuoo6u.com.pl (fastflux)"; content:"|07|yhuoo6u|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhuyu6y.com.pl (fastflux)"; content:"|07|yhuyu6y|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourgoogleanalytics.eu (zbot)"; content:"|13|yourgoogleanalytics|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zevakaru1.com (trojan )"; content:"|09|zevakaru1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup host3.idfc2.info (malware)"; content:"|05|host3|05|idfc2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup householdsout.cn (malware)"; content:"|0d|householdsout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibiza.1gb.ua (malware)"; content:"|05|ibiza|03|1gb|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2600warez.net (coolwebsearch)"; content:"|09|2600warez|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2611570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2youre.com (malware)"; content:"|06|2youre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33333.4499a.cn (trojan)"; content:"|05|33333|05|4499a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4499a.cn (malware)"; content:"|05|4499a|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51edm.net (malware)"; content:"|05|51edm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6alava.com (zeus)"; content:"|06|6alava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 71709.com (malware)"; content:"|05|71709|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 777769.com (malware)"; content:"|06|777769|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aae.bij.pl (trojan)"; content:"|03|aae|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aba.bij.pl (malware)"; content:"|03|aba|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adslash.com (malware)"; content:"|07|adslash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwrestelnin.com (zeus)"; content:"|0c|adwrestelnin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajsfiheuvffa.com (trojan)"; content:"|0c|ajsfiheuvffa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alfaheidi.is (koobface)"; content:"|09|alfaheidi|02|is"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analiticcontrol.net (exploit)"; content:"|0f|analiticcontrol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anatine.in (malware)"; content:"|07|anatine|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivi-areus.net (rogue)"; content:"|0c|antivi-areus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro2scan.com (malware)"; content:"|11|antiviruspro2scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro7scan.com (malware)"; content:"|11|antiviruspro7scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro8scan.com (malware)"; content:"|11|antiviruspro8scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspro9scan.com (malware)"; content:"|11|antiviruspro9scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apcsecure.com (rogue)"; content:"|09|apcsecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arhewi.com.pl (malware)"; content:"|06|arhewi|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arketwood.com (koobface)"; content:"|09|arketwood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armordefender.com (rogue)"; content:"|0d|armordefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurora-groupco.tw (moneymule)"; content:"|0e|aurora-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurora-groupco.ws (moneymule)"; content:"|0e|aurora-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurora-groupinc.tw (moneymule)"; content:"|0f|aurora-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurora-groupinc.ws (moneymule)"; content:"|0f|aurora-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup authentictype.ru (iframe)"; content:"|0d|authentictype|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axul13.com (trojan)"; content:"|06|axul13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup base7711.com (zeus)"; content:"|08|base7711|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmultimediaworld.com (malware)"; content:"|13|bestmultimediaworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bij.pl (malware)"; content:"|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bint-tjnn.com (malware)"; content:"|09|bint-tjnn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogi.gpsforum.sk (malware)"; content:"|04|bogi|08|gpsforum|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup branderideklub.dk (koobface)"; content:"|0e|branderideklub|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brsqb.cn (malware)"; content:"|05|brsqb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulletproofsoft.com (rogue)"; content:"|0f|bulletproofsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chafes.info (malware)"; content:"|06|chafes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chernobyl.cc (moneymule)"; content:"|09|chernobyl|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chernobylcc.org (moneymule)"; content:"|0b|chernobylcc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chernobylcchrmail.org (moneymule)"; content:"|11|chernobylcchrmail|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chernobylhrmail.org (moneymule)"; content:"|0f|chernobylhrmail|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chits.biz (harmful)"; content:"|05|chits|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cihaz.info (exploit)"; content:"|05|cihaz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup club.9istyle.com (malware)"; content:"|04|club|07|9istyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cobalttrueblue.ru (iframe)"; content:"|0e|cobalttrueblue|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup com222.net (malware)"; content:"|06|com222|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cometruestar.ru (iframe)"; content:"|0c|cometruestar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counterengine.net (malware)"; content:"|0d|counterengine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbsclick.com (malware)"; content:"|08|dbsclick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhkgpylwrl.com (malware)"; content:"|0a|dhkgpylwrl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogphotography.nl (trojan)"; content:"|0e|dogphotography|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotvst37.cn (malware)"; content:"|08|dotvst37|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.facecooker.com (malware)"; content:"|04|down|0a|facecooker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down1130.iwillhavesexygirls.com (malware)"; content:"|08|down1130|12|iwillhavesexygirls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr15.com (malware)"; content:"|0d|downloadavr15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr20.com (malware)"; content:"|0d|downloadavr20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr30.com (malware)"; content:"|0d|downloadavr30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr40.com (malware)"; content:"|0d|downloadavr40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr50.com (malware)"; content:"|0d|downloadavr50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-autosystem.gr (koobface)"; content:"|0c|e-autosystem|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electromusicnow.cn (zeus)"; content:"|0f|electromusicnow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ermisp.gr (koobface)"; content:"|06|ermisp|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erotic-food.ch (koobface)"; content:"|0b|erotic-food|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup essentiuz.com (neosploit)"; content:"|09|essentiuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feda-wien.at (koobface)"; content:"|09|feda-wien|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file.winnerstudy.net (malware)"; content:"|04|file|0b|winnerstudy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstrew.com (bot)"; content:"|08|firstrew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivestar.ch (koobface)"; content:"|08|fivestar|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fwlink.nx7.zedo.com.adslash.com (exploit)"; content:"|06|fwlink|03|nx7|04|zedo|03|com|07|adslash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalstopaids.org (trojan)"; content:"|0e|globalstopaids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gochatting.co.uk (trojan)"; content:"|0a|gochatting|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-freehost.ru (trojan)"; content:"|0f|google-freehost|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hcgalleri.com (koobface)"; content:"|09|hcgalleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herangi.com (koobface)"; content:"|07|herangi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info-web.main.jp (threat)"; content:"|08|info-web|04|main|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inkqoevl.cn (malware)"; content:"|08|inkqoevl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup is.t1ll.loveu.count.xj.cn (trojan)"; content:"|02|is|04|t1ll|05|loveu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup is.t7i1ll.loveu.count.xj.cn (trojan)"; content:"|02|is|06|t7i1ll|05|loveu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup is.t7ill.loveu.count.xj.cn (trojan)"; content:"|02|is|05|t7ill|05|loveu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup is.till.loveu.count.xj.cn (trojan)"; content:"|02|is|04|till|05|loveu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist1ill.love.u.count.xj.cn (trojan)"; content:"|07|ist1ill|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist3i1ll.lov.eu.count.xj.cn (trojan)"; content:"|08|ist3i1ll|03|lov|02|eu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist3ill.lov.eu.count.xj.cn (trojan)"; content:"|07|ist3ill|03|lov|02|eu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist4il1l.love.u.count.xj.cn (trojan)"; content:"|08|ist4il1l|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist4ill.love.u.count.xj.cn (trojan)"; content:"|07|ist4ill|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist5il1l.lo.veu.count.xj.cn (trojan)"; content:"|08|ist5il1l|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist5ill.lo.veu.count.xj.cn (trojan)"; content:"|07|ist5ill|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist6il1l.lo.veu.count.xj.cn (trojan)"; content:"|08|ist6il1l|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ist6ill.lo.veu.count.xj.cn (trojan)"; content:"|07|ist6ill|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti11ll.love.u.count.xj.cn (trojan)"; content:"|08|isti11ll|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti1ll.love.u.count.xj.cn (trojan)"; content:"|07|isti1ll|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti21ll.lo.veu.count.xj.cn (trojan)"; content:"|08|isti21ll|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti2ll.lo.veu.count.xj.cn (trojan)"; content:"|07|isti2ll|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti5ll.lo.veu.count.xj.cn (trojan)"; content:"|07|isti5ll|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isti6ll.lo.veu.count.xj.cn (trojan)"; content:"|07|isti6ll|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istil3l.lov.eu.count.xj.cn (trojan)"; content:"|07|istil3l|03|lov|02|eu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istil4l.love.u.count.xj.cn (trojan)"; content:"|07|istil4l|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istill.lo.veu.count.xj.cn (trojan)"; content:"|06|istill|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istill.lov.eu.count.xj.cn (trojan)"; content:"|06|istill|03|lov|02|eu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istill.love.u.count.xj.cn (trojan)"; content:"|06|istill|04|love|01|u|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup istill2.lo.veu.count.xj.cn (trojan)"; content:"|07|istill2|02|lo|03|veu|05|count|02|xj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jippings.com (exploit)"; content:"|08|jippings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loosale.com (trojan)"; content:"|07|loosale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loxmad.com (zeus)"; content:"|06|loxmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magneskapcsolo.hu (iframe)"; content:"|0e|magneskapcsolo|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magnumopus.dk (koobface)"; content:"|0a|magnumopus|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamarubik.in (backdoor)"; content:"|09|mamarubik|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maquinaslitograficas.com (zeus)"; content:"|14|maquinaslitograficas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdwyt.com (trojan)"; content:"|05|mdwyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moloky.com (trojan)"; content:"|06|moloky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydatabasedirect.net (zeus)"; content:"|10|mydatabasedirect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytijn.org (malware)"; content:"|06|mytijn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newliveplayer.com (malware)"; content:"|0d|newliveplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nm.fcrazy.com (zeus)"; content:"|02|nm|06|fcrazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partner-groupinc.ws (moneymule)"; content:"|10|partner-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectdefender.com (rogue)"; content:"|0f|protectdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectsoldier.com (rogue)"; content:"|0e|protectsoldier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup przeklej.pl (trojan)"; content:"|08|przeklej|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptxk.com (malware)"; content:"|04|ptxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qaqaqaqa.com (trojan)"; content:"|08|qaqaqaqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qbxq16.com (zeus)"; content:"|06|qbxq16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvod.com (malware)"; content:"|04|qvod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radyoliva.com (threat)"; content:"|09|radyoliva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rainmannn.org (trojan)"; content:"|09|rainmannn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refda.com (trojan)"; content:"|05|refda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refslst.com (trojan)"; content:"|07|refslst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup render-groupinc.ws (moneymule)"; content:"|0f|render-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riadkenzo.com (koobface)"; content:"|09|riadkenzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbeqpirscun.com (neosploit)"; content:"|0b|sbeqpirscun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secline333.net (zeus)"; content:"|0a|secline333|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureorderstore.com (scam)"; content:"|10|secureorderstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silence7.cn (zeus)"; content:"|08|silence7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superpropicks.ru (iframe)"; content:"|0d|superpropicks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supertruelife.ru (iframe)"; content:"|0d|supertruelife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swanjin.com (rogue)"; content:"|07|swanjin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therealmckoy.com (trojan)"; content:"|0c|therealmckoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timsmurf.com (koobface)"; content:"|08|timsmurf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tmunvictoria.com (koobface)"; content:"|0c|tmunvictoria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trade-statistics.com (exploit)"; content:"|10|trade-statistics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffs.biz (harmful)"; content:"|06|traffs|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truelifefamily.ru (iframe)"; content:"|0e|truelifefamily|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ty.lnlycnc.cn (trojan)"; content:"|02|ty|07|lnlycnc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubojnajasila.net (zeus)"; content:"|0c|ubojnajasila|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateqs.org (scam)"; content:"|08|updateqs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usagooglevideo.info (malware)"; content:"|0e|usagooglevideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veggiemama.com.hk (koobface)"; content:"|0a|veggiemama|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipimagine.cn (rogue)"; content:"|0a|vipimagine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourauthentic.ru (iframe)"; content:"|0d|yourauthentic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourenterain.com (exploit)"; content:"|0c|yourenterain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmaxmedia.ru (iframe)"; content:"|0c|yourmaxmedia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtruegame.ru (iframe)"; content:"|0c|yourtruegame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtruemate.ru (iframe)"; content:"|0c|yourtruemate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarcoexchange.biz (moneymule)"; content:"|0d|zarcoexchange|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarcoexchange.info (moneymule)"; content:"|0d|zarcoexchange|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarcoexchange.net (moneymule)"; content:"|0d|zarcoexchange|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarcoexchange.org (moneymule)"; content:"|0d|zarcoexchange|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zexmad.com (zeus)"; content:"|06|zexmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intermillercvt.freehostwebs.com (malware)"; content:"|0e|intermillercvt|0c|freehostwebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iss9w8s89xx.org (exploit)"; content:"|0b|iss9w8s89xx|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iswim.co.il (malware)"; content:"|05|iswim|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jupiukl.cz (fastflux)"; content:"|07|jupiukl|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew1.com (malware)"; content:"|0a|justinnew1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew13.com (malware)"; content:"|0b|justinnew13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew14.com (malware)"; content:"|0b|justinnew14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew15.com (malware)"; content:"|0b|justinnew15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew19.com (malware)"; content:"|0b|justinnew19|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew2.com (malware)"; content:"|0a|justinnew2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew20.com (malware)"; content:"|0b|justinnew20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew21.com (malware)"; content:"|0b|justinnew21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew3.com (malware)"; content:"|0a|justinnew3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew7.com (malware)"; content:"|0a|justinnew7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew8.com (malware)"; content:"|0a|justinnew8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew9.com (malware)"; content:"|0a|justinnew9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kitaydomn.in (malware)"; content:"|09|kitaydomn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopiukl.cz (fastflux)"; content:"|07|lopiukl|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maaltsxg.cn (malware)"; content:"|08|maaltsxg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus-scanner0.com (malware)"; content:"|17|microantivirus-scanner0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus-scanner1.com (malware)"; content:"|17|microantivirus-scanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus-scanner3.com (malware)"; content:"|17|microantivirus-scanner3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus-scanner5.com (malware)"; content:"|17|microantivirus-scanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus-scanner9.com (malware)"; content:"|17|microantivirus-scanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirusscanner1.com (malware)"; content:"|16|microantivirusscanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirusscanner2.com (malware)"; content:"|16|microantivirusscanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirusscanner6.com (malware)"; content:"|16|microantivirusscanner6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirusscanner8.com (malware)"; content:"|16|microantivirusscanner8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirusscanner9.com (malware)"; content:"|16|microantivirusscanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moncasesdd.in (malware)"; content:"|0a|moncasesdd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morcnsterpiss11.com (fastflux)"; content:"|0f|morcnsterpiss11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morcnsterpiss12.com (fastflux)"; content:"|0f|morcnsterpiss12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morcnsterpiss13.com (fastflux)"; content:"|0f|morcnsterpiss13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morcnsterpiss14.com (fastflux)"; content:"|0f|morcnsterpiss14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morcnsterpiss8.com (fastflux)"; content:"|0e|morcnsterpiss8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mundopumavirtualx01.in (malware)"; content:"|13|mundopumavirtualx01|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newshadowofyoursecurity.com (trojan)"; content:"|17|newshadowofyoursecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsmeta.net (exploits )"; content:"|08|newsmeta|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nexon.cz (threat)"; content:"|05|nexon|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup no-vironyourpc.com (rogue)"; content:"|0e|no-vironyourpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notproblem.com (exploits )"; content:"|0a|notproblem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novironyourpc.net (rogue)"; content:"|0d|novironyourpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oniframe.com (exploits )"; content:"|08|oniframe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pefero.co.cc (exploits )"; content:"|06|pefero|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectesecurity.com (trojan)"; content:"|10|perfectesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntube2000.com (exploit)"; content:"|0c|porntube2000|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokobon.com (exploits )"; content:"|07|rokobon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanosansar.com (exploit)"; content:"|0a|sanosansar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sasheen.com (exploit)"; content:"|07|sasheen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-file.org (malware)"; content:"|09|save-file|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serchapi.co.cc (exploit)"; content:"|08|serchapi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shadowofyoursecuritynow.com (trojan)"; content:"|17|shadowofyoursecuritynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shadowofyoursecurityonline.com (trojan)"; content:"|1a|shadowofyoursecurityonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ships.ath.cx (zeus)"; content:"|05|ships|03|ath|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ships.zapto.org (zeus)"; content:"|05|ships|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shuchinsk.net (malware)"; content:"|09|shuchinsk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smithyguy.com (zeus)"; content:"|09|smithyguy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spl0a.in (exploits )"; content:"|05|spl0a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssdfsdfwefwefwe.com (exploit)"; content:"|0f|ssdfsdfwefwefwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup star2gams.com (zeus)"; content:"|09|star2gams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sucipa.com.vc (zbot)"; content:"|06|sucipa|03|com|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sucipe.com.vc (zbot)"; content:"|06|sucipe|03|com|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sucipe.vc (zbot)"; content:"|06|sucipe|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sucipy.com.vc (zbot)"; content:"|06|sucipy|03|com|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sucipy.vc (zbot)"; content:"|06|sucipy|02|vc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suez.services.00-com.info (zeus)"; content:"|04|suez|08|services|06|00-com|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swimwearswimsuit.co.uk (exploit)"; content:"|10|swimwearswimsuit|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup takest.info (rogue)"; content:"|06|takest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teams3.cn (malware)"; content:"|06|teams3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terrrfsd.be (zbot)"; content:"|08|terrrfsd|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 16a.us (malware)"; content:"|03|16a|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 180searchassistant.com (spyware)"; content:"|12|180searchassistant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1gb.ru (harmful)"; content:"|03|1gb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2601560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2mgames.com (harmful)"; content:"|07|2mgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2611449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 35561.com (harmful)"; content:"|05|35561|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 43242.com (harmful)"; content:"|05|43242|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51.la (malware)"; content:"|02|51|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terrrfsr.co.uk (zbot)"; content:"|08|terrrfsr|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terrrfsr.me.uk (zbot)"; content:"|08|terrrfsr|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ak-sh.by.ru (harmful)"; content:"|05|ak-sh|02|by|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alpenkeyss.com (exploit)"; content:"|0a|alpenkeyss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analizersyscom.net (exploit)"; content:"|0e|analizersyscom|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antconspool.net (exploit)"; content:"|0b|antconspool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiddoss.net (exploit)"; content:"|09|antiddoss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antipoollss.net (exploit)"; content:"|0b|antipoollss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspstone-co.com (virus)"; content:"|0b|aspstone-co|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atewikijp.com (virus)"; content:"|09|atewikijp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atiboolkss.com (exploit)"; content:"|0a|atiboolkss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagirans.com (exploit)"; content:"|08|bagirans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barigi.com (exploit)"; content:"|06|barigi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombabaab.net (exploit)"; content:"|09|bombabaab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brekercon.com (exploit)"; content:"|09|brekercon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulletcool.net (exploit)"; content:"|0a|bulletcool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckrack-lab.com (exploit)"; content:"|0a|ckrack-lab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolbayss.net (exploit)"; content:"|09|coolbayss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystal-pro-scan.com (rogue)"; content:"|10|crystal-pro-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d3v-p0int.co.cc (malware)"; content:"|09|d3v-p0int|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dadadadas.net (exploit)"; content:"|09|dadadadas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datahistorys.com (exploit)"; content:"|0c|datahistorys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domaintens.net (exploit)"; content:"|0a|domaintens|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadavr60.com (malware)"; content:"|0d|downloadavr60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup driedshoes.com (malware)"; content:"|0a|driedshoes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excitysjp.com (virus)"; content:"|09|excitysjp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feroydayss.net (exploit)"; content:"|0a|feroydayss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forward-sleep.com (exploit)"; content:"|0d|forward-sleep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freekpeeg.net (exploit)"; content:"|09|freekpeeg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galodankeyss.com (exploit)"; content:"|0c|galodankeyss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genoceidas.net (exploit)"; content:"|0a|genoceidas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genuinecolors.ru (malware)"; content:"|0d|genuinecolors|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gergrafiks.net (exploit)"; content:"|0a|gergrafiks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidropanikass.com (malware)"; content:"|0d|gidropanikass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalinsss.net (exploit)"; content:"|0b|globalinsss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlexistence.com (phishing)"; content:"|0e|googlexistence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hausvogt.net (threat)"; content:"|08|hausvogt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icqsystemc.com (exploit)"; content:"|0a|icqsystemc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incivfalitss.net (exploit)"; content:"|0c|incivfalitss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iner.kz (harmful)"; content:"|04|iner|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latax.gov.cn (harmful)"; content:"|05|latax|03|gov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limocs.cn (exploit)"; content:"|06|limocs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-computer-scanb2.com (rogue)"; content:"|14|live-computer-scanb2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lockershoes.cn (trojan )"; content:"|0b|lockershoes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loquat2006.cn (trojan )"; content:"|0a|loquat2006|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loveruili.com.cn (trojan )"; content:"|09|loveruili|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lthtgg.cn (trojan )"; content:"|06|lthtgg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltml5658.com.cn (trojan )"; content:"|08|ltml5658|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lttrade.com.cn (trojan )"; content:"|07|lttrade|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ludingtour.cn (trojan )"; content:"|0a|ludingtour|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luntaifxc.cn (trojan )"; content:"|09|luntaifxc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv51.cn (trojan )"; content:"|04|lv51|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwctd.cn (trojan )"; content:"|05|lwctd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lxwjp.cn (trojan )"; content:"|05|lxwjp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyglj.cn (trojan )"; content:"|05|lyglj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lykenai.cn (trojan )"; content:"|07|lykenai|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyqxfz.cn (trojan )"; content:"|06|lyqxfz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lysflhc.com.cn (trojan )"; content:"|07|lysflhc|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lytea365.cn (trojan )"; content:"|08|lytea365|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lytx360.cn (trojan )"; content:"|07|lytx360|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzboyi.cn (trojan )"; content:"|06|lzboyi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzds.net.cn (trojan )"; content:"|04|lzds|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzkumoozdl.cn (trojan )"; content:"|0a|lzkumoozdl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzsf888.cn (trojan )"; content:"|07|lzsf888|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m1ntnews.com.cn (trojan )"; content:"|08|m1ntnews|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabcdf.com.cn (trojan )"; content:"|06|mabcdf|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maer2008.cn (trojan )"; content:"|08|maer2008|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainefr4u.com (rogue)"; content:"|09|mainefr4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malimali.net.cn (trojan )"; content:"|08|malimali|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marinecargo.cn (trojan )"; content:"|0b|marinecargo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcldesign.com.cn (trojan )"; content:"|09|mcldesign|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcsenling.com.cn (trojan )"; content:"|09|mcsenling|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meiguixiang.cn (trojan )"; content:"|0b|meiguixiang|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meijialighting.com.cn (trojan )"; content:"|0e|meijialighting|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mekonlife.com.cn (trojan )"; content:"|09|mekonlife|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup menshuans.com (exploit)"; content:"|09|menshuans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mf555.cn (trojan )"; content:"|05|mf555|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup midiwei.com.cn (trojan )"; content:"|07|midiwei|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mindleak.com (malware)"; content:"|08|mindleak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mingyun.net.cn (trojan )"; content:"|07|mingyun|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mlsqs.cn (trojan )"; content:"|05|mlsqs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmtogo.cn (trojan )"; content:"|06|mmtogo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momolele.cn (trojan )"; content:"|08|momolele|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msjx.net.cn (trojan )"; content:"|04|msjx|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mu432.cn (trojan )"; content:"|05|mu432|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muliuyiliao.cn (trojan )"; content:"|0b|muliuyiliao|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-way.cn (trojan )"; content:"|06|my-way|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywj.net.cn (trojan )"; content:"|04|mywj|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nashk.cn (trojan )"; content:"|05|nashk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbazhibo5.cn (trojan )"; content:"|09|nbazhibo5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ncsxfmzp.cn (trojan )"; content:"|08|ncsxfmzp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netengine.com.cn (trojan )"; content:"|09|netengine|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netnetnets.net (exploit)"; content:"|0a|netnetnets|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newjijin.cn (trojan )"; content:"|08|newjijin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicovideojps.com (virus)"; content:"|0c|nicovideojps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niglonic.cn (trojan )"; content:"|08|niglonic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninerland.cn (trojan )"; content:"|09|ninerland|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nizomerss.com (exploit)"; content:"|09|nizomerss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njbssw.cn (trojan )"; content:"|06|njbssw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njfarson.cn (trojan )"; content:"|08|njfarson|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njhcs.cn (trojan )"; content:"|05|njhcs|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njyj365.com.cn (trojan )"; content:"|07|njyj365|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup njyxwd.com.cn (trojan )"; content:"|06|njyxwd|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmhairong.cn (trojan )"; content:"|09|nmhairong|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nowpost.cn (trojan )"; content:"|07|nowpost|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsjck.com.cn (trojan )"; content:"|05|nsjck|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntrsgov.cn (trojan )"; content:"|07|ntrsgov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntyw.js.cn (trojan )"; content:"|04|ntyw|02|js|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olibo.com.cn (trojan )"; content:"|05|olibo|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onepiece-online.cn (trojan )"; content:"|0f|onepiece-online|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ooaa88.cn (trojan )"; content:"|06|ooaa88|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ouyayijia.cn (trojan )"; content:"|09|ouyayijia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p2008.cn (trojan )"; content:"|05|p2008|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pandora21.com.cn (trojan )"; content:"|09|pandora21|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup param-pram.com (exploit)"; content:"|0a|param-pram|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbjc315.cn (trojan )"; content:"|07|pbjc315|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peak-e.cn (trojan )"; content:"|06|peak-e|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pei-yi.cn (trojan )"; content:"|06|pei-yi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pengyou888.com.cn (trojan )"; content:"|0a|pengyou888|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinganhao.cn (trojan )"; content:"|09|pinganhao|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pingcrews.in (malware)"; content:"|09|pingcrews|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pingheyou.cn (trojan )"; content:"|09|pingheyou|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pizihui169.cn (trojan )"; content:"|0a|pizihui169|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pkpen118.cn (trojan )"; content:"|08|pkpen118|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playmays.com (exploit)"; content:"|08|playmays|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmma888.cn (trojan )"; content:"|07|pmma888|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poolsss.net (exploit)"; content:"|07|poolsss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poorly.com.cn (trojan )"; content:"|06|poorly|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popmpam.com (exploit)"; content:"|07|popmpam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppmatee.cn (trojan )"; content:"|07|ppmatee|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prefiranc.com (exploit)"; content:"|09|prefiranc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup product168.com.cn (trojan )"; content:"|0a|product168|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup productguide.cn (trojan )"; content:"|0c|productguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proeasy.com.cn (trojan )"; content:"|07|proeasy|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psder.cn (trojan )"; content:"|05|psder|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup publicdomainsss.net (exploit)"; content:"|0f|publicdomainsss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pujiangzhen.com.cn (trojan )"; content:"|0b|pujiangzhen|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup px66.cn (trojan )"; content:"|04|px66|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pypbbs.com.cn (trojan )"; content:"|06|pypbbs|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pyyl007.com.cn (trojan )"; content:"|07|pyyl007|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qdnzhmz.cn (trojan )"; content:"|07|qdnzhmz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qdxybl.cn (trojan )"; content:"|06|qdxybl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qianjiaxinwuzi.com.cn (trojan )"; content:"|0e|qianjiaxinwuzi|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qleo.cn (trojan )"; content:"|04|qleo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq2018.cn (trojan )"; content:"|06|qq2018|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqdiao.cn (trojan )"; content:"|06|qqdiao|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqlc02.cn (trojan )"; content:"|06|qqlc02|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqxqrz.cn (trojan )"; content:"|06|qqxqrz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qvartzs.com (exploit)"; content:"|07|qvartzs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rakerkc.com (exploit)"; content:"|07|rakerkc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raopingpacific.com.cn (trojan )"; content:"|0e|raopingpacific|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realever.com.cn (trojan )"; content:"|08|realever|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refresh-news.com (exploit)"; content:"|0c|refresh-news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rich198.cn (trojan )"; content:"|07|rich198|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rikangchen.cn (trojan )"; content:"|0a|rikangchen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ripn33.cn (trojan )"; content:"|06|ripn33|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup risingbannerstands.cn (trojan )"; content:"|12|risingbannerstands|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rongxindj.cn (trojan )"; content:"|09|rongxindj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rongxinwaimao.com.cn (trojan )"; content:"|0d|rongxinwaimao|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roprice.net (virus)"; content:"|07|roprice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtmpornlink.com (harmful)"; content:"|0b|rtmpornlink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salescamss.com (exploit)"; content:"|0a|salescamss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartbuyc.com (exploit)"; content:"|09|smartbuyc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosbaysos.com (exploit)"; content:"|09|sosbaysos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sposhss.net (exploit)"; content:"|07|sposhss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-medias.com (exploit)"; content:"|0b|stop-medias|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemtlds.net (exploit)"; content:"|0a|systemtlds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup temateman.com (virus)"; content:"|09|temateman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-start2010.com (zeus)"; content:"|0d|the-start2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestcleanofpc.com (rogue)"; content:"|10|thebestcleanofpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todaysavess.com (exploit)"; content:"|0b|todaysavess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trak-kreck.com (exploit)"; content:"|0a|trak-kreck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup travicil.com (exploit)"; content:"|08|travicil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yaplogjp.com (virus)"; content:"|08|yaplogjp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zznews.gov.cn (harmful)"; content:"|06|zznews|03|gov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelivingdeserta.com (rogue)"; content:"|10|thelivingdeserta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advanced-defender.net (rogue)"; content:"|11|advanced-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-staffdefender.com (rogue)"; content:"|11|all-staffdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allstaffdefender.net (rogue)"; content:"|10|allstaffdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analys-thread.com (rogue)"; content:"|0d|analys-thread|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-doitscanpc.net (rogue)"; content:"|0f|auto-doitscanpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autodoit-scanpc.net (rogue)"; content:"|0f|autodoit-scanpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autodoitscan-pc.net (rogue)"; content:"|0f|autodoitscan-pc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besafe-fornow.com (rogue)"; content:"|0d|besafe-fornow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besafe-with-us.in (rogue)"; content:"|0e|besafe-with-us|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-pcguard.com (rogue)"; content:"|0c|best-pcguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanviron-mypc-pc.com (rogue)"; content:"|12|cleanviron-mypc-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanvironmypc.net (rogue)"; content:"|0e|cleanvironmypc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaf-video.de (malware)"; content:"|0a|deaf-video|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scanandcleansoft.net (rogue)"; content:"|15|fast-scanandcleansoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastcureat-yourcomp.net (rogue)"; content:"|13|fastcureat-yourcomp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastguard-cleaneronpc.in (rogue)"; content:"|15|fastguard-cleaneronpc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastguardcleaneron-pc.in (rogue)"; content:"|15|fastguardcleaneron-pc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastguardcleaneronpc.com (rogue)"; content:"|14|fastguardcleaneronpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup final-years-scan.net (rogue)"; content:"|10|final-years-scan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getsmartscanofpc.com (rogue)"; content:"|10|getsmartscanofpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goinforcure-pc.net (rogue)"; content:"|0e|goinforcure-pc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitoncleanatpc.com (rogue)"; content:"|0e|hitoncleanatpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hold-uponyourpc.net (rogue)"; content:"|0f|hold-uponyourpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotcleanof-yourpc.net (rogue)"; content:"|11|hotcleanof-yourpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indeep-scanonpc.net (rogue)"; content:"|0f|indeep-scanonpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew10.com (zeus)"; content:"|0b|justinnew10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew11.com (zeus)"; content:"|0b|justinnew11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew12.com (zeus)"; content:"|0b|justinnew12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew16.com (zeus)"; content:"|0b|justinnew16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew17.com (zeus)"; content:"|0b|justinnew17|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew18.com (zeus)"; content:"|0b|justinnew18|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew4.com (zeus)"; content:"|0a|justinnew4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew5.com (zeus)"; content:"|0a|justinnew5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justinnew6.com (zeus)"; content:"|0a|justinnew6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keep-your-pcsafe.net (rogue)"; content:"|10|keep-your-pcsafe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastcheckonmy-zone.net (rogue)"; content:"|12|lastcheckonmy-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup let-ustrytoclean.com (rogue)"; content:"|10|let-ustrytoclean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letus-trytoclean.com (rogue)"; content:"|10|letus-trytoclean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letustry-toclean.com (rogue)"; content:"|10|letustry-toclean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letustryto-clean.com (rogue)"; content:"|10|letustryto-clean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letustryto-clean.net (rogue)"; content:"|10|letustryto-clean|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveguardfordata.com (rogue)"; content:"|10|liveguardfordata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveguardforpc.com (rogue)"; content:"|0e|liveguardforpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup most-safepcscanguard.net (rogue)"; content:"|14|most-safepcscanguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mostsafepcscan-guard.net (rogue)"; content:"|14|mostsafepcscan-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-pcsecure-advisor.net (rogue)"; content:"|13|my-pcsecure-advisor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-pcsecureadvisor.net (rogue)"; content:"|12|my-pcsecureadvisor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-system-scanner.net (rogue)"; content:"|11|my-system-scanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypc-protection.com (rogue)"; content:"|0f|mypc-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypc-secureadvisor.com (rogue)"; content:"|12|mypc-secureadvisor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypcs-ecure-advisor.net (rogue)"; content:"|13|mypcs-ecure-advisor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypcsecureadvisor.com (rogue)"; content:"|11|mypcsecureadvisor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysystem-defender.net (rogue)"; content:"|11|mysystem-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-advanced-sys-check.net (rogue)"; content:"|16|new-advanced-sys-check|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-advancedsyscheck.net (rogue)"; content:"|14|new-advancedsyscheck|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-sysdefender.net (rogue)"; content:"|0f|new-sysdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-system-protection.net (rogue)"; content:"|15|new-system-protection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-systemdefender.net (rogue)"; content:"|12|new-systemdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newadvanced-syscheck.net (rogue)"; content:"|14|newadvanced-syscheck|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newadvancedsyscheck.com (rogue)"; content:"|13|newadvancedsyscheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newadvancedsyscheck.net (rogue)"; content:"|13|newadvancedsyscheck|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoftscanner.net (rogue)"; content:"|0e|newsoftscanner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newstaffdefender.net (rogue)"; content:"|10|newstaffdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsys-defender.net (rogue)"; content:"|0f|newsys-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsysdefender.in (rogue)"; content:"|0e|newsysdefender|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsystem-defender.net (rogue)"; content:"|12|newsystem-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsystemprotection.net (rogue)"; content:"|13|newsystemprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinecentralstore.com (zeus/wsnpoem)"; content:"|12|onlinecentralstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinecheck-andscanpc.net (rogue)"; content:"|15|onlinecheck-andscanpc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optioptix45-serche.net (zeus/wsnpoem)"; content:"|12|optioptix45-serche|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcqook.com (trojan)"; content:"|06|pcqook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsecurenet.com (rogue)"; content:"|0b|pcsecurenet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcssecure.com (rogue)"; content:"|09|pcssecure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup performspywarescan5.com (rogue)"; content:"|13|performspywarescan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pine-guardofmypc.net (rogue)"; content:"|10|pine-guardofmypc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pineguard-of-mypc.net (rogue)"; content:"|11|pineguard-of-mypc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pineguard-of-pc.com (rogue)"; content:"|0f|pineguard-of-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pineguard-ofmy-pc.net (rogue)"; content:"|11|pineguard-ofmy-pc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pineguardofmypc.net (rogue)"; content:"|0f|pineguardofmypc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinpinpongs.com (zeus/wsnpoem)"; content:"|0b|pinpinpongs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjmtrading.com (zeus/wsnpoem)"; content:"|0a|pjmtrading|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postcodeknaller.nl (zeus/wsnpoem)"; content:"|0f|postcodeknaller|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosecurity-14.com (rogue)"; content:"|0e|prosecurity-14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup real-pc-scannow.net (rogue)"; content:"|0f|real-pc-scannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup real-zonescannow.net (rogue)"; content:"|10|real-zonescannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realpc-scannow.net (rogue)"; content:"|0e|realpc-scannow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realpcscan-now.net (rogue)"; content:"|0e|realpcscan-now|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realzonescan-now.net (rogue)"; content:"|10|realzonescan-now|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recrush.ru (zeus/wsnpoem)"; content:"|07|recrush|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refslisrt.com (trojan)"; content:"|09|refslisrt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refslit.com (trojan)"; content:"|07|refslit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup refunds.tax.state-id.us (exploit)"; content:"|07|refunds|03|tax|08|state-id|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rgmbiz.org (zeus/wsnpoem)"; content:"|06|rgmbiz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rittaklassik.com (zeus/wsnpoem)"; content:"|0c|rittaklassik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-for-pc.com (rogue)"; content:"|0b|scan-for-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-pc-now.biz (malware)"; content:"|0b|scan-pc-now|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-pc-now.info (malware)"; content:"|0b|scan-pc-now|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-pcdefender.in (rogue)"; content:"|11|search-pcdefender|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servertransporternews.com (zeus/wsnpoem)"; content:"|15|servertransporternews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-for-scan.com (rogue)"; content:"|0d|soft-for-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-protected.com (rogue)"; content:"|0e|soft-protected|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softscan-pro.net (rogue)"; content:"|0c|softscan-pro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startscanlabatpc.com (rogue)"; content:"|10|startscanlabatpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systempc-scan-check.com (rogue)"; content:"|13|systempc-scan-check|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toborochihosting.com (threat)"; content:"|10|toborochihosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup triplexfund.com (malware)"; content:"|0b|triplexfund|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upcleanyour-pcnow.com (rogue)"; content:"|11|upcleanyour-pcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upcleanyourpcnow.net (rogue)"; content:"|10|upcleanyourpcnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vircheckpc-pc.com (rogue)"; content:"|0d|vircheckpc-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vircuremy-pcnow.com (rogue)"; content:"|0f|vircuremy-pcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpcbest-defender.com (rogue)"; content:"|13|yourpcbest-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpcbestdefender.com (rogue)"; content:"|12|yourpcbestdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourzone-bestdefender.in (rogue)"; content:"|15|yourzone-bestdefender|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourzonebestdefender.com (rogue)"; content:"|14|yourzonebestdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourzonebestdefender.in (rogue)"; content:"|14|yourzonebestdefender|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lite-antispyware-scan.com (harmful)"; content:"|15|lite-antispyware-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteantispywarescan.com (harmful)"; content:"|13|liteantispywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tofu-china.com (zeus)"; content:"|0a|tofu-china|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tonset.com (trojan)"; content:"|06|tonset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup townwet.com (trojan)"; content:"|07|townwet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trashiugar.info (zeus/wsnpoem)"; content:"|0a|trashiugar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ub8.net (malware)"; content:"|03|ub8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2high-five.com (rogue)"; content:"|0a|2high-five|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6623.info (threat)"; content:"|04|6623|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe10-togeam.cn (zeus)"; content:"|0e|adobe10-togeam|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advancebases.com (trojan)"; content:"|0c|advancebases|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwoords.net (exploits )"; content:"|08|adwoords|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeiconseil.com (exploit)"; content:"|0a|aeiconseil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al9s.biz (threat)"; content:"|04|al9s|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alltoponline.com (exploit)"; content:"|0c|alltoponline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analiticcontrol.com (exploit)"; content:"|0f|analiticcontrol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analiticdirect.com (exploit)"; content:"|0e|analiticdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analytics.us.com (attacksite)"; content:"|09|analytics|02|us|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analytiss.com (exploits )"; content:"|09|analytiss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anrdlauno.com (malware)"; content:"|09|anrdlauno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusacademy.com (rogue)"; content:"|10|antivirusacademy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusbetter.com (threat)"; content:"|0f|antivirusbetter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artcell.info (zeus)"; content:"|07|artcell|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autouploaders.net (exploit)"; content:"|0d|autouploaders|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avondaleacademy.com (threat)"; content:"|0f|avondaleacademy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awesome-dvd.com (exploit)"; content:"|0b|awesome-dvd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awesomeesecurity.com (trojan)"; content:"|10|awesomeesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badmodels.biz (exploit)"; content:"|09|badmodels|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bandbmlc.it (zeus)"; content:"|08|bandbmlc|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barrysphotography.net (exploit)"; content:"|11|barrysphotography|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautifull-life.net (zeus)"; content:"|0f|beautifull-life|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biaobrgeroin.cn (zeus)"; content:"|0c|biaobrgeroin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bidwm.org (exploit)"; content:"|05|bidwm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bikeweekrallys.com (exploit)"; content:"|0e|bikeweekrallys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blendament.com (zeus)"; content:"|0a|blendament|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blitzbeatz.com (exploit)"; content:"|0a|blitzbeatz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluegreenallegator.com (trojan)"; content:"|12|bluegreenallegator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borshecoins.co.uk (zeus)"; content:"|0b|borshecoins|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bothlok.com (rogue)"; content:"|07|bothlok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bothlooik.com (rogue)"; content:"|09|bothlooik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brothervonmash.com (zeus)"; content:"|0e|brothervonmash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bumagajet.net (zeus)"; content:"|09|bumagajet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campinglesbruyeres.com (exploit)"; content:"|12|campinglesbruyeres|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casionew.com (exploits )"; content:"|08|casionew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapnetdiscounts.com (rogue)"; content:"|11|cheapnetdiscounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codiframe.net (exploits )"; content:"|09|codiframe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coloradoshop.info (zeus)"; content:"|0c|coloradoshop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coupons2discounts.com (rogue)"; content:"|11|coupons2discounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystal-pro-antivirus.com (rogue)"; content:"|15|crystal-pro-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dayprofi.com (malware)"; content:"|08|dayprofi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddwworks.com (exploit)"; content:"|08|ddwworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete-all-virus-33.com (rogue)"; content:"|13|delete-all-virus-33|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ditrnbibarsp.com (exploit)"; content:"|0c|ditrnbibarsp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnusax.com (trojan)"; content:"|06|dnusax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dometype.com (rogue)"; content:"|08|dometype|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup douglasequipment.com (exploit)"; content:"|10|douglasequipment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dubaigatehost.com (malware)"; content:"|0d|dubaigatehost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easygiftgiving.com (malware)"; content:"|0e|easygiftgiving|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eccinput.com (exploit)"; content:"|08|eccinput|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efgjhtieuno.com (threat)"; content:"|0b|efgjhtieuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eometype.com (rogue)"; content:"|08|eometype|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epcat.net (exploit)"; content:"|05|epcat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estguard.com (threat)"; content:"|08|estguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrassecuritynow.com (malware)"; content:"|11|extrassecuritynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fantastictools.com (zeus)"; content:"|0e|fantastictools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favorit-network.com (malware)"; content:"|0f|favorit-network|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fetzenflieger.at (malware)"; content:"|0d|fetzenflieger|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fructik.ru (bot)"; content:"|07|fructik|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funtixandcompany.com (zeus)"; content:"|10|funtixandcompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghiltypacific.com (zeus)"; content:"|0d|ghiltypacific|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosafezone.net (rogue)"; content:"|0a|gosafezone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattaby.com (exploit)"; content:"|09|greattaby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grummerhens.net (zeus)"; content:"|0b|grummerhens|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsmthebest.ro (exploit)"; content:"|0a|gsmthebest|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostwaydcs.com (malware)"; content:"|0a|hostwaydcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsbcgroup.ru (zeus)"; content:"|09|hsbcgroup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huesosam.net (zeus)"; content:"|08|huesosam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iframeoff.org (exploits )"; content:"|09|iframeoff|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intleft.net (zeus)"; content:"|07|intleft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuylqb.cn (zeus)"; content:"|06|iuylqb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j2c-crib.com (zeus)"; content:"|08|j2c-crib|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jikurakis.com (exploit)"; content:"|09|jikurakis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juanmm.cn (trojan)"; content:"|06|juanmm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kelandiciv.net (zeus)"; content:"|0a|kelandiciv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup korat2.go.th (exploit)"; content:"|06|korat2|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laiserattack.com (zeus)"; content:"|0c|laiserattack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lake777.homeip.net (zeus)"; content:"|07|lake777|06|homeip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightcounter.in (malware)"; content:"|0c|lightcounter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linmaoshuiqing.cn (zeus)"; content:"|0e|linmaoshuiqing|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteantispywarescanner.com (harmful)"; content:"|16|liteantispywarescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveiframe.com (exploits )"; content:"|0a|liveiframe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lokosale.com (trojan)"; content:"|08|lokosale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loribel.fr (exploits )"; content:"|07|loribel|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lozkawodne24.eu (exploit)"; content:"|0c|lozkawodne24|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malegebi251.21sys21.cn (exploit)"; content:"|0b|malegebi251|07|21sys21|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-antispywaret.com (rogue)"; content:"|11|mega-antispywaret|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metafarm.org (exploits )"; content:"|08|metafarm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metaiframe.org (exploits )"; content:"|0a|metaiframe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milleniumleaders.com (exploit)"; content:"|10|milleniumleaders|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjjia.cn (malware)"; content:"|05|mjjia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobylearn.biz (malware)"; content:"|09|mobylearn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monstclick.in (malware)"; content:"|0a|monstclick|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murom-hotel.com (exploit)"; content:"|0b|murom-hotel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwrtorks2cv.in (malware)"; content:"|0b|mwrtorks2cv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myextrassecurity.com (trojan)"; content:"|10|myextrassecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myshadowofyoursecurity.com (trojan)"; content:"|16|myshadowofyoursecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazarkebab.pl (exploit)"; content:"|0a|nazarkebab|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ndt.110mb.com (exploit)"; content:"|03|ndt|05|110mb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netcarfind.cn (zeus)"; content:"|0a|netcarfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new2body.net (exploits )"; content:"|08|new2body|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newbrother2010.freehostwebs.com (trojan)"; content:"|0e|newbrother2010|0c|freehostwebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newesafety.com (trojan)"; content:"|0a|newesafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newesupport.com (trojan)"; content:"|0b|newesupport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news.21npc.com (exploit)"; content:"|04|news|05|21npc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninivekha.net (threat)"; content:"|09|ninivekha|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup now-scan-pc.com (malware)"; content:"|0b|now-scan-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oberaufseher.net (trojan)"; content:"|0c|oberaufseher|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ok10000.net.cn (malware)"; content:"|07|ok10000|03|net|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parsrabota.reg36.ru (exploit)"; content:"|0a|parsrabota|05|reg36|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup permanentgoodazmark.com (zeus)"; content:"|13|permanentgoodazmark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalchefbuffet.com.br (malware)"; content:"|12|personalchefbuffet|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup php.metago.cn (harmful)"; content:"|03|php|06|metago|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portenotu.com (harmful)"; content:"|09|portenotu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rkdefender.eu (malware)"; content:"|0a|rkdefender|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureantibot.net (malware)"; content:"|0d|secureantibot|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup services.00-com.info (zeus/wsnpoem)"; content:"|08|services|06|00-com|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sevenstars7.com (worm)"; content:"|0b|sevenstars7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sg12scanner.com (harmful)"; content:"|0b|sg12scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sg9scanner.com (harmful)"; content:"|0a|sg9scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sole-doro.com (threat)"; content:"|09|sole-doro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somrtype.com (rogue)"; content:"|08|somrtype|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukmiukl.com.pl (fastflux)"; content:"|07|ukmiukl|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewiframe.org (exploits )"; content:"|0a|viewiframe|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsetutvse.net (exploits )"; content:"|09|vsetutvse|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wilkytoolbar.net.in (zeus)"; content:"|0c|wilkytoolbar|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woodstocklandconservancy.org (exploit)"; content:"|18|woodstocklandconservancy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwmeta.org (exploits )"; content:"|07|wwwmeta|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydsalon.net (exploit)"; content:"|07|ydsalon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 135mp3.com (malware)"; content:"|06|135mp3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultmanheroes.com (zeus/wsnpoem)"; content:"|0c|ultmanheroes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 114anhui.com (harmful)"; content:"|08|114anhui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 114baines.com (harmful)"; content:"|09|114baines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 114central.com (harmful)"; content:"|0a|114central|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 114graph.com (harmful)"; content:"|08|114graph|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2015wyt.net (harmful)"; content:"|07|2015wyt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2018wyt.net (harmful)"; content:"|07|2018wyt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4slllj.cn (harmful)"; content:"|06|4slllj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6tg7.cn (harmful)"; content:"|04|6tg7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7u8f.cn (harmful)"; content:"|04|7u8f|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 807090.cn (harmful)"; content:"|06|807090|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aagnfdjkgn.com (harmful)"; content:"|0a|aagnfdjkgn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abcaef.cn (harmful)"; content:"|06|abcaef|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afubwbmsce.com (harmful)"; content:"|0a|afubwbmsce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup al1pay9.com.cn (harmful)"; content:"|07|al1pay9|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-malware-live-scan.com (harmful)"; content:"|16|anti-malware-live-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-malware-scanner.com (harmful)"; content:"|14|anti-malware-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-online-scan.com (harmful)"; content:"|17|antimalware-online-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-pro-scanner.com (harmful)"; content:"|17|antimalware-pro-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-scan.com (harmful)"; content:"|10|antimalware-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-scanner.com (harmful)"; content:"|13|antimalware-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwareguard-plus.com (harmful)"; content:"|15|antimalwareguard-plus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwareinternetscan.com (harmful)"; content:"|17|antimalwareinternetscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwareonlinescan.com (harmful)"; content:"|15|antimalwareonlinescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwareproscanner.com (harmful)"; content:"|15|antimalwareproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarescanner.com (harmful)"; content:"|12|antimalwarescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaresuperproscan.com (harmful)"; content:"|17|antimalwaresuperproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyscanner13.com (harmful)"; content:"|10|antispyscanner13|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-pro-dl.com (harmful)"; content:"|12|antispyware-pro-dl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-scanner-2009.com (harmful)"; content:"|18|antispyware-scanner-2009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarefastcheck.com (harmful)"; content:"|14|antispywarefastcheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareinternetproscan.com (harmful)"; content:"|1a|antispywareinternetproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareliveproscan.com (harmful)"; content:"|16|antispywareliveproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviralscanner14.com (harmful)"; content:"|12|antiviralscanner14|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auctlva.com (harmful)"; content:"|07|auctlva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badware-protector.com (rogue)"; content:"|11|badware-protector|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidmn.cn (harmful)"; content:"|06|baidmn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidusib.cn (harmful)"; content:"|08|baidusib|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautywithbeads.com (harmful)"; content:"|0f|beautywithbeads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestanti-virusscan.com (harmful)"; content:"|12|bestanti-virusscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispywarelivescan.com (harmful)"; content:"|17|bestantispywarelivescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantispywarescan.com (harmful)"; content:"|13|bestantispywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botconnet.cn (harmful)"; content:"|09|botconnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chatloveonline.com (harmful)"; content:"|0e|chatloveonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computerantivirusproscanner.com (harmful)"; content:"|1b|computerantivirusproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computeronlineproscanner.com (harmful)"; content:"|18|computeronlineproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computeronlinescan.com (harmful)"; content:"|12|computeronlinescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conexnet.cn (harmful)"; content:"|08|conexnet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmosi.ru (harmful)"; content:"|07|cosmosi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cu108.com (harmful)"; content:"|05|cu108|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deinglaube.com (harmful)"; content:"|0a|deinglaube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derenfop.cn (harmful)"; content:"|08|derenfop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detguide.cn (harmful)"; content:"|08|detguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlink0.cn (harmful)"; content:"|0b|directlink0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlink1.cn (harmful)"; content:"|0b|directlink1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlink2.cn (harmful)"; content:"|0b|directlink2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlink4.cn (harmful)"; content:"|0b|directlink4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directlink9.cn (harmful)"; content:"|0b|directlink9|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dl.ms-as-storage.com (harmful)"; content:"|02|dl|0d|ms-as-storage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup do21.net (harmful)"; content:"|04|do21|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvlorg.net (harmful)"; content:"|06|dvlorg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-search.ru (harmful)"; content:"|0d|google-search|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gougom.cn (harmful)"; content:"|06|gougom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gszk.net (harmful)"; content:"|04|gszk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hello-to-you.net (harmful)"; content:"|0c|hello-to-you|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heroextra.com (harmful)"; content:"|09|heroextra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhj8.cn (harmful)"; content:"|04|hhj8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhj9.cn (harmful)"; content:"|04|hhj9|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horobl.cn (harmful)"; content:"|06|horobl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hynno8744.cn (harmful)"; content:"|09|hynno8744|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghh1.cn (harmful)"; content:"|05|kghh1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghh2.cn (harmful)"; content:"|05|kghh2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghh3.cn (harmful)"; content:"|05|kghh3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghh4.cn (harmful)"; content:"|05|kghh4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghh5.cn (harmful)"; content:"|05|kghh5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l4jsll.cn (harmful)"; content:"|06|l4jsll|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup light-money.cn (harmful)"; content:"|0b|light-money|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lite-anti-virus-scanner.com (harmful)"; content:"|17|lite-anti-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lj4sll.cn (harmful)"; content:"|06|lj4sll|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luckffxi.com (harmful)"; content:"|08|luckffxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareprosecurityscanner.com (harmful)"; content:"|19|malwareprosecurityscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medamphetamin.cn (harmful)"; content:"|0d|medamphetamin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mimibn.cn (harmful)"; content:"|06|mimibn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muu998.com (harmful)"; content:"|06|muu998|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nepaxek-domain.cn (harmful)"; content:"|0e|nepaxek-domain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notvirus.com (harmful)"; content:"|08|notvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okokss.com (harmful)"; content:"|06|okokss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-pc-virus-scanner.com (harmful)"; content:"|17|online-pc-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineanalytics.cn (harmful)"; content:"|0f|onlineanalytics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinepcvirusscanner.com (harmful)"; content:"|14|onlinepcvirusscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineproantispywarescan.com (harmful)"; content:"|18|onlineproantispywarescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup originalcn.cn (harmful)"; content:"|0a|originalcn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc2009-antivr.net (harmful)"; content:"|0d|pc2009-antivr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcantivirusscanneronline.com (harmful)"; content:"|18|pcantivirusscanneronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pld.nailimpro.cn (harmful)"; content:"|03|pld|09|nailimpro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premium-antivirus-defence.com (harmful)"; content:"|19|premium-antivirus-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq-new.cn (harmful)"; content:"|06|qq-new|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqqeeeww.cn (harmful)"; content:"|08|qqqeeeww|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmk-lgs.com (harmful)"; content:"|07|rmk-lgs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanworldguide.com (harmful)"; content:"|0e|scanworldguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityscanworld.com (harmful)"; content:"|11|securityscanworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seotraff.biz (harmful)"; content:"|08|seotraff|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgviralscan.com (harmful)"; content:"|0b|sgviralscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sl4llj.cn (harmful)"; content:"|06|sl4llj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slalaka.biz (harmful)"; content:"|07|slalaka|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sll4362.cn (harmful)"; content:"|07|sll4362|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sll4lj.cn (harmful)"; content:"|06|sll4lj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slll4j.cn (harmful)"; content:"|06|slll4j|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slllj4.cn (harmful)"; content:"|06|slllj4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stabilitysolutionslook.com (harmful)"; content:"|16|stabilitysolutionslook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statclick.net (harmful)"; content:"|09|statclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superioradz.info (harmful)"; content:"|0b|superioradz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sw-ww.ws (harmful)"; content:"|05|sw-ww|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup test.metago.cn (harmful)"; content:"|04|test|06|metago|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalmalwareprotection.com (harmful)"; content:"|16|totalmalwareprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalvirusprotection.com (harmful)"; content:"|14|totalvirusprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trackgame.net (harmful)"; content:"|09|trackgame|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trasoregon.com (harmful)"; content:"|0a|trasoregon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin1.cn (harmful)"; content:"|04|uin1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin2.cn (harmful)"; content:"|04|uin2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin3.cn (harmful)"; content:"|04|uin3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uin4.cn (harmful)"; content:"|04|uin4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unioke.info (rogue)"; content:"|06|unioke|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upd-windows-microsoft.cn (harmful)"; content:"|15|upd-windows-microsoft|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userpaymntdownload.com (harmful)"; content:"|12|userpaymntdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vide0portal.com (harmful)"; content:"|0b|vide0portal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viping.com.br (harmful)"; content:"|06|viping|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wdswe.com (harmful)"; content:"|05|wdswe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xp-extra.com (harmful)"; content:"|08|xp-extra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xp-police.com (harmful)"; content:"|09|xp-police|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxvvvv.cn (harmful)"; content:"|07|xxxvvvv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandex2.cn (harmful)"; content:"|07|yandex2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourvalueready.com (harmful)"; content:"|0e|yourvalueready|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherishpoems.com (threat)"; content:"|0c|cherishpoems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup criticalcool.com (exploit)"; content:"|0c|criticalcool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrabrake.com (harmful)"; content:"|0a|extrabrake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honeypalace.cn (harmful)"; content:"|0b|honeypalace|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hquvkbdve.com (harmful)"; content:"|09|hquvkbdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup universalpicturesspain.es (exploit)"; content:"|16|universalpicturesspain|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpvirusprotection.com (malware)"; content:"|11|xpvirusprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-torrent.com (malware)"; content:"|0b|get-torrent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uopiukl.cz (fastflux)"; content:"|07|uopiukl|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24jd.co.cc (malware)"; content:"|04|24jd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 384756783900.cn (moneymule)"; content:"|0c|384756783900|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 67gr.co.tv (malware)"; content:"|04|67gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6ccc.ru (malware)"; content:"|04|6ccc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77gr.co.tv (malware)"; content:"|04|77gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 783456788839.cn (moneymule)"; content:"|0c|783456788839|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aau.bij.pl (malware)"; content:"|03|aau|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup accountlogin.saouar-ncsoft.com (malware)"; content:"|0c|accountlogin|0d|saouar-ncsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads.honestjohn.co.uk (malware)"; content:"|03|ads|0a|honestjohn|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advs.rach.com.sg (malware)"; content:"|04|advs|04|rach|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarecomp.com (fake_antivirus)"; content:"|0f|antispywarecomp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live-one.com (fake_antivirus)"; content:"|12|antivirus-live-one|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scan-wizarda.com (fake_antivirus)"; content:"|16|antivirus-scan-wizarda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scan-wizardc.com (fake_antivirus)"; content:"|16|antivirus-scan-wizardc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scan-wizardd.com (fake_antivirus)"; content:"|16|antivirus-scan-wizardd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scan-wizarde.com (fake_antivirus)"; content:"|16|antivirus-scan-wizarde|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-scan-wizardf.com (fake_antivirus)"; content:"|16|antivirus-scan-wizardf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-wizard-d5.com (fake_antivirus)"; content:"|13|antivirus-wizard-d5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-wizard-e6.com (fake_antivirus)"; content:"|13|antivirus-wizard-e6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus2010pro.com (fake_antivirus)"; content:"|10|antivirus2010pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruswizard.org (fake_antivirus)"; content:"|0f|antiviruswizard|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aop1.homelinux.com (aurora_malware)"; content:"|04|aop1|09|homelinux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup app1.homelinux.com (aurora_malware)"; content:"|04|app1|09|homelinux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apsight.ru (malware)"; content:"|07|apsight|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arber.us (exploit)"; content:"|05|arber|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup archive.zinnko.be (malware)"; content:"|07|archive|06|zinnko|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scan.org (fake_antivirus)"; content:"|0e|av-online-scan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avalaz.info (malware)"; content:"|06|avalaz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bahoy.net (malware)"; content:"|05|bahoy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banconsol.com (phishing)"; content:"|09|banconsol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banginbeckyblog.com (harmful)"; content:"|0f|banginbeckyblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbcnewss.avh.cx (aurora_malware)"; content:"|08|bbcnewss|03|avh|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bet-portal.com (phishing)"; content:"|0a|bet-portal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betgrandslam.com (phishing)"; content:"|0c|betgrandslam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackhatcodebreaker.com (malware)"; content:"|13|blackhatcodebreaker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brainzzz.net (malware)"; content:"|08|brainzzz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brutapukamuk.com (malware)"; content:"|0c|brutapukamuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buy-internetsecurity.com (fake_antivirus)"; content:"|14|buy-internetsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camforuss.com (malware)"; content:"|09|camforuss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cddvdwriter.com (malware)"; content:"|0b|cddvdwriter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cefincf.com (moneymule)"; content:"|07|cefincf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cement-bag.com (malware)"; content:"|0a|cement-bag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickgooglo.com (malware)"; content:"|0b|clickgooglo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnyijiaying.com.cn (malware)"; content:"|0b|cnyijiaying|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comicscaner.cn (malware)"; content:"|0b|comicscaner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compuguard.info (malware)"; content:"|0a|compuguard|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectproxy.3322.org (aurora_malware)"; content:"|0c|connectproxy|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contentcleaner.com (fake_antivirus)"; content:"|0e|contentcleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2687.downloadarchivex.com (malware)"; content:"|08|core2687|10|downloadarchivex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cp332308.cpanel.tech-logol.ru (malware)"; content:"|08|cp332308|06|cpanel|0a|tech-logol|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csjbo.info (malware)"; content:"|05|csjbo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadserialcrack.com (malware)"; content:"|13|downloadserialcrack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup driverpro.org (malware)"; content:"|09|driverpro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsfad.in (malware)"; content:"|05|dsfad|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-mule-it.com (malware)"; content:"|09|e-mule-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecoolwatch.com (phishing)"; content:"|0a|ecoolwatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emule-it.com (malware)"; content:"|08|emule-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facilsex.com.ar (malware)"; content:"|08|facilsex|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farmeset.com (malware)"; content:"|08|farmeset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffsvrs.com (phishing)"; content:"|06|ffsvrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup for-sunny-smile.com (malware)"; content:"|0f|for-sunny-smile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forhappysex.com (malware)"; content:"|0b|forhappysex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frameste.com (malware)"; content:"|08|frameste|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fraudgedt.com (malware)"; content:"|09|fraudgedt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freebest4.info (malware)"; content:"|09|freebest4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frudget.com (malware)"; content:"|07|frudget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geewong.org (malware)"; content:"|07|geewong|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-spyware.com (malware)"; content:"|0c|good-spyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytics.su (malware)"; content:"|10|google-analytics|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotworse.cn (malware)"; content:"|08|gotworse|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horosta.ru (malware)"; content:"|07|horosta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huliganseres.net (malware)"; content:"|0c|huliganseres|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inlakehouse.com (malware)"; content:"|0b|inlakehouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jtmqypcgt.info (malware)"; content:"|09|jtmqypcgt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klaikius.com (malware)"; content:"|08|klaikius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kripw.com (malware)"; content:"|05|kripw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lehmanbrotherbankruptcy.com (harmful)"; content:"|17|lehmanbrotherbankruptcy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letitbit.zinnko.pl (malware)"; content:"|08|letitbit|06|zinnko|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-windows-security.com (malware)"; content:"|1a|microsoft-windows-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynes-consultings.cn (moneymule)"; content:"|11|mynes-consultings|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nazarethimaging.com (risk)"; content:"|0f|nazarethimaging|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pes2009.biz (malware)"; content:"|07|pes2009|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectedsystem.in (harmful)"; content:"|0f|protectedsystem|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protective-program.com (malware)"; content:"|12|protective-program|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raudget.com (malware)"; content:"|07|raudget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repek.or.kr (phishing)"; content:"|05|repek|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityantivirus.com (rogue)"; content:"|11|securityantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securixp.com (malware)"; content:"|08|securixp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjfdhw395t.com (zeus)"; content:"|0a|sjfdhw395t|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sneakyboy.com (malware)"; content:"|09|sneakyboy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sulikavan.us (malware)"; content:"|09|sulikavan|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup textsex.biz (malware)"; content:"|07|textsex|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topdns241.com (malware)"; content:"|09|topdns241|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatect.org (rogue)"; content:"|08|updatect|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useclean-atyour-sys.in (rogue)"; content:"|13|useclean-atyour-sys|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vinodelam.net (malware)"; content:"|09|vinodelam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webnomoney.com (malware)"; content:"|0a|webnomoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winxpupdate.org (malware)"; content:"|0b|winxpupdate|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xx4b83603e.ru (malware)"; content:"|0a|xx4b83603e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zanosi-bablo.com (malware)"; content:"|0c|zanosi-bablo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zief.pl (threat)"; content:"|04|zief|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veton.biz (zeus/wsnpoem)"; content:"|05|veton|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 360.homeunix.com (aurora_malware)"; content:"|03|360|08|homeunix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 888viet.com (phishing)"; content:"|07|888viet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-config-s3.net (zeus)"; content:"|0f|adobe-config-s3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobefreesoftware.com (malware)"; content:"|11|adobefreesoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwarepronow.com (fake_antivirus)"; content:"|0c|adwarepronow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allstaffdefender.com (rogue)"; content:"|10|allstaffdefender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alt1.homelinux.com (aurora_malware)"; content:"|04|alt1|09|homelinux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ameimx.com (malware_host)"; content:"|06|ameimx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amt1.homelinux.com (aurora_malware)"; content:"|04|amt1|09|homelinux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anabolic-pharma.com (phishing)"; content:"|0f|anabolic-pharma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-2010.com (fake_antivirus)"; content:"|10|antimalware-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antisgetout.cn (cutwail/pandex/pushdo)"; content:"|0b|antisgetout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filoups.info (aurora_malware)"; content:"|07|filoups|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fireasseye.com (cutwail/pandex/pushdo)"; content:"|0a|fireasseye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashdownloadv11.com (malware)"; content:"|10|flashdownloadv11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freecapch.info (malware_host)"; content:"|09|freecapch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpaccess.cc (aurora_malware)"; content:"|09|ftpaccess|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuckbriankrebs.com (cutwail/pandex/pushdo)"; content:"|0e|fuckbriankrebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-spyware-destroyer.com (fake_antivirus)"; content:"|15|get-spyware-destroyer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getantivirusplusnow.com (rogue)"; content:"|13|getantivirusplusnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gink22hok.com (rogue)"; content:"|09|gink22hok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-a-security.com (malware)"; content:"|11|global-a-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-b-security.com (malware)"; content:"|11|global-b-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-c-security.com (malware)"; content:"|11|global-c-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-d-security.com (malware)"; content:"|11|global-d-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup global-z-security.com (malware)"; content:"|11|global-z-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.com.analytics.egilkemecun.com (malware)"; content:"|06|google|03|com|09|analytics|0b|egilkemecun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.homeuni8.com (aurora_malware)"; content:"|06|google|08|homeuni8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.homeunix.com (aurora_malware)"; content:"|06|google|08|homeunix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.homeunkx.com (aurora_malware)"; content:"|06|google|08|homeunkx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guards-pc.com (fake_antivirus)"; content:"|09|guards-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardwww.com (fake_antivirus)"; content:"|08|guardwww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgyou1.yourfreehosting.net (malware)"; content:"|07|imgyou1|0f|yourfreehosting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter0virus-scan.com (fake_antivirus)"; content:"|10|inter0virus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter8virus-scan.com (fake_antivirus)"; content:"|10|inter8virus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-free-webgames.com (phishing)"; content:"|16|internet-free-webgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-protect-pc.info (fake_antivirus)"; content:"|0f|just-protect-pc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinolinks.com (phishing)"; content:"|09|kinolinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klalkius.com (exploit)"; content:"|08|klalkius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup learnwholesalesecrets.com (phishing)"; content:"|15|learnwholesalesecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lexusbestparts.com (malware)"; content:"|0e|lexusbestparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadpartners.com (phishing)"; content:"|0c|loadpartners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwares-in.net (fake_antivirus)"; content:"|0b|malwares-in|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security11.com (fake_antivirus)"; content:"|18|max-antivirus-security11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security22.com (fake_antivirus)"; content:"|18|max-antivirus-security22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security4.com (fake_antivirus)"; content:"|17|max-antivirus-security4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security5.com (fake_antivirus)"; content:"|17|max-antivirus-security5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security55.com (fake_antivirus)"; content:"|18|max-antivirus-security55|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security6.com (fake_antivirus)"; content:"|17|max-antivirus-security6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security7.com (fake_antivirus)"; content:"|17|max-antivirus-security7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security77.com (fake_antivirus)"; content:"|18|max-antivirus-security77|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max-antivirus-security9.com (fake_antivirus)"; content:"|17|max-antivirus-security9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max1antispyware.com (fake_antivirus)"; content:"|0f|max1antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max2antispyware.com (fake_antivirus)"; content:"|0f|max2antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max4antispyware.com (fake_antivirus)"; content:"|0f|max4antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max6antispyware.com (fake_antivirus)"; content:"|0f|max6antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup max7antispyware.com (fake_antivirus)"; content:"|0f|max7antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merin22.mooo.com (rogue)"; content:"|07|merin22|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantiviruslive.com (fake_antivirus)"; content:"|12|microantiviruslive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mr-tr0jan.no-ip.biz (malware)"; content:"|09|mr-tr0jan|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecurityland.com (rogue)"; content:"|0e|mysecurityland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup navy-antispywarea.com (fake_antivirus)"; content:"|11|navy-antispywarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-av-scannera.com (fake_antivirus)"; content:"|0f|new-av-scannera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-system-guard.in (malware)"; content:"|10|new-system-guard|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsystem-guard.in (rogue)"; content:"|0f|newsystem-guard|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nokrizis2.org (malware_host)"; content:"|09|nokrizis2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oduvanchic.com (cutwail/pandex/pushdo)"; content:"|0a|oduvanchic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentsafety.net (rogue)"; content:"|0d|paymentsafety|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsecurity-soft.com (fake_antivirus)"; content:"|0f|pcsecurity-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pidersli.net (zeus)"; content:"|08|pidersli|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podgribami.org (malware_host)"; content:"|0a|podgribami|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pro-2in1-securityh.com (malware)"; content:"|12|pro-2in1-securityh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectedfield.in (rogue)"; content:"|0e|protectedfield|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qbzq16.com (zeus)"; content:"|06|qbzq16|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registrycleanersreviewed.com (fake_antivirus)"; content:"|18|registrycleanersreviewed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remote-pc-scannerv.com (malware)"; content:"|12|remote-pc-scannerv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remote-pc1-scanner.com (malware)"; content:"|12|remote-pc1-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup remotepaybill.com (malware)"; content:"|0d|remotepaybill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rescuesysupdate.com (malware)"; content:"|0f|rescuesysupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetyearth.net (rogue)"; content:"|0b|safetyearth|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samsonite-shop.cz (trojan)"; content:"|0e|samsonite-shop|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-destroya.com (fake_antivirus)"; content:"|11|scan-and-destroya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-destroye.com (fake_antivirus)"; content:"|11|scan-and-destroye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-destroyt.com (fake_antivirus)"; content:"|11|scan-and-destroyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-destroyw.com (fake_antivirus)"; content:"|11|scan-and-destroyw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-and-destroyz.com (fake_antivirus)"; content:"|11|scan-and-destroyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4virus-onlinea.com (fake_antivirus)"; content:"|12|scan4virus-onlinea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4virus-onlined.com (fake_antivirus)"; content:"|12|scan4virus-onlined|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4virus-onlinet.com (fake_antivirus)"; content:"|12|scan4virus-onlinet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4virus-onlinew.com (fake_antivirus)"; content:"|12|scan4virus-onlinew|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4virus-onlinne.com (fake_antivirus)"; content:"|12|scan4virus-onlinne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scriptwb.com (exploit)"; content:"|08|scriptwb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secondome.com (malware_host)"; content:"|09|secondome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-plus-payments.com (rogue)"; content:"|14|secure-plus-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.privatesecuredpayments.com (rogue)"; content:"|06|secure|16|privatesecuredpayments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securepcav.com (fake_antivirus)"; content:"|0a|securepcav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-tool2010.com (fake_antivirus)"; content:"|11|security-tool2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sl1.homelinux.org (aurora_malware)"; content:"|03|sl1|09|homelinux|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-2-antispyware.com (fake_antivirus)"; content:"|13|smart-2-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-3-antispyware.com (fake_antivirus)"; content:"|13|smart-3-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-7-antispyware.com (fake_antivirus)"; content:"|13|smart-7-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-8-antispyware.com (fake_antivirus)"; content:"|13|smart-8-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-9-antispyware.com (fake_antivirus)"; content:"|13|smart-9-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-av-scan1.com (fake_antivirus)"; content:"|0e|smart-av-scan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-av-scan3.com (fake_antivirus)"; content:"|0e|smart-av-scan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-av-scan5.com (fake_antivirus)"; content:"|0e|smart-av-scan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-av-scan7.com (fake_antivirus)"; content:"|0e|smart-av-scan7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-av-scan9.com (fake_antivirus)"; content:"|0e|smart-av-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart1antivirus.com (fake_antivirus)"; content:"|0f|smart1antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart2antivirus.com (fake_antivirus)"; content:"|0f|smart2antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart4antivirus.com (fake_antivirus)"; content:"|0f|smart4antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvirus-scan1.com (fake_antivirus)"; content:"|10|smartvirus-scan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvirus-scan3.com (fake_antivirus)"; content:"|10|smartvirus-scan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvirus-scan4.com (fake_antivirus)"; content:"|10|smartvirus-scan4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvirus-scan6.com (fake_antivirus)"; content:"|10|smartvirus-scan6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartvirus-scan8.com (fake_antivirus)"; content:"|10|smartvirus-scan8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-detectora.com (fake_antivirus)"; content:"|0d|spy-detectora|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-detectorc.com (fake_antivirus)"; content:"|0d|spy-detectorc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-detectore.com (fake_antivirus)"; content:"|0d|spy-detectore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-detectorf.com (fake_antivirus)"; content:"|0d|spy-detectorf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-detectork.com (fake_antivirus)"; content:"|0d|spy-detectork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spy-sheriff.tk (fake_antivirus)"; content:"|0b|spy-sheriff|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-max-scan2.com (fake_antivirus)"; content:"|11|spyware-max-scan2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-max-scan3.com (fake_antivirus)"; content:"|11|spyware-max-scan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-max-scan5.com (fake_antivirus)"; content:"|11|spyware-max-scan5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-max-scan7.com (fake_antivirus)"; content:"|11|spyware-max-scan7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-max-scan9.com (fake_antivirus)"; content:"|11|spyware-max-scan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaredestroyerone.com (fake_antivirus)"; content:"|13|spywaredestroyerone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaremaxscan1.com (fake_antivirus)"; content:"|0f|spywaremaxscan1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaremaxscan3.com (fake_antivirus)"; content:"|0f|spywaremaxscan3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaremaxscan4.com (fake_antivirus)"; content:"|0f|spywaremaxscan4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaremaxscan6.com (fake_antivirus)"; content:"|0f|spywaremaxscan6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywaremaxscan9.com (fake_antivirus)"; content:"|0f|spywaremaxscan9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareremovalguides.com (malware)"; content:"|14|spywareremovalguides|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop-virus-server.com (fake_antivirus)"; content:"|11|stop-virus-server|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super1antispyware.com (fake_antivirus)"; content:"|11|super1antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super4antispyware.com (fake_antivirus)"; content:"|11|super4antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super6antispyware.com (fake_antivirus)"; content:"|11|super6antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super7antispyware.com (fake_antivirus)"; content:"|11|super7antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tax.state-nm.com (malware)"; content:"|03|tax|08|state-nm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tax.state-ok.com (malware)"; content:"|03|tax|08|state-ok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torrentabuser.com (malware)"; content:"|0d|torrentabuser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyuqwer.dyndns.org (aurora_malware)"; content:"|07|tyuqwer|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update.ourhobby.com (aurora_malware)"; content:"|06|update|08|ourhobby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vasd.info (ambler)"; content:"|04|vasd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videodivertentigratis.net (exploit)"; content:"|15|videodivertentigratis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vinefirebot.com (malware)"; content:"|0b|vinefirebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detectora.com (fake_antivirus)"; content:"|0f|virus-detectora|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detectorc.com (fake_antivirus)"; content:"|0f|virus-detectorc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detectord.com (fake_antivirus)"; content:"|0f|virus-detectord|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detectorj.com (fake_antivirus)"; content:"|0f|virus-detectorj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-detectort.com (fake_antivirus)"; content:"|0f|virus-detectort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voanews.ath.cx (aurora_malware)"; content:"|07|voanews|03|ath|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezaccess.com (malware)"; content:"|0b|warezaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webswan.33iqst.com (aurora_malware)"; content:"|07|webswan|06|33iqst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win6best-scanner.com (fake_antivirus)"; content:"|10|win6best-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windef2010.com (malware)"; content:"|0a|windef2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsaltserver.com (fake_antivirus)"; content:"|10|windowsaltserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winxp7server.com (malware)"; content:"|0c|winxp7server|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ymail.ath.cx (aurora_malware)"; content:"|05|ymail|03|ath|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vseserioznocb.megabyet.net (zeus/wsnpoem)"; content:"|0d|vseserioznocb|08|megabyet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhtianyu.net (harmful)"; content:"|08|dhtianyu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsantivirusserver2.com (rogue)"; content:"|17|windowsantivirusserver2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdatesserv.com (harmful)"; content:"|0e|winupdatesserv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfilex.info (zeus/wsnpoem)"; content:"|06|xfilex|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3000channelsplus.com (fraud/scam)"; content:"|10|3000channelsplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 70-music.com (fraud/scam)"; content:"|08|70-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 90-music.com (fraud/scam)"; content:"|08|90-music|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alldigitalchannels.com (fraud/scam)"; content:"|12|alldigitalchannels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allmoviesnow.net (fraud/scam)"; content:"|0c|allmoviesnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americanautobargains.com (fraud/scam)"; content:"|14|americanautobargains|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-scamco.net (zbot)"; content:"|0b|anti-scamco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqaqaqaq.com (kneber_zeus)"; content:"|08|aqaqaqaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arequipalinda.com (malware)"; content:"|0d|arequipalinda|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ares-downloadnow.com (fraud/scam)"; content:"|10|ares-downloadnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aresdownloadnow.com (fraud/scam)"; content:"|0f|aresdownloadnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aresgalaxydownloads.com (fraud/scam)"; content:"|13|aresgalaxydownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autobargainsnetwork.com (fraud/scam)"; content:"|13|autobargainsnetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avchecker123.com (kneber_zeus)"; content:"|0c|avchecker123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bear-groupco.ws (fraud)"; content:"|0c|bear-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bear-groupinc.ws (fraud)"; content:"|0d|bear-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup better-fitness.com (fraud/scam)"; content:"|0e|better-fitness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizelitt.com (kneber_zeus)"; content:"|08|bizelitt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bloggingforsuccess.com (fraud/scam)"; content:"|12|bloggingforsuccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup britishsupport.net (kneber_zeus)"; content:"|0e|britishsupport|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaujoi.cn (kneber_zeus)"; content:"|07|chaujoi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citizen-groupco.tw (fraud)"; content:"|0f|citizen-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citizen-groupco.ws (fraud)"; content:"|0f|citizen-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citizen-groupsvc.tw (fraud)"; content:"|10|citizen-groupsvc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citizengroupinc.ws (moneymule)"; content:"|0f|citizengroupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classic-groupco.ws (fraud)"; content:"|0f|classic-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classic-groupsvc.tw (fraud)"; content:"|10|classic-groupsvc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classicgroupinc.ws (moneymule)"; content:"|0f|classicgroupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djbormand.cn (kneber_zeus)"; content:"|09|djbormand|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.haozip.com (malware)"; content:"|08|download|06|haozip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdxpremium.com (fraud/scam)"; content:"|0b|dvdxpremium|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdxultra.com (fraud/scam)"; content:"|09|dvdxultra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elenailyina.com (malware)"; content:"|0b|elenailyina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emoore.info (malware)"; content:"|06|emoore|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-groupco.tw (fraud)"; content:"|0d|excel-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-groupinc.tw (fraud)"; content:"|0e|excel-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-groupinc.ws (fraud)"; content:"|0e|excel-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-groupsvc.ws (fraud)"; content:"|0e|excel-groupsvc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expertbucks.com (fraud/scam)"; content:"|0b|expertbucks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup explosioncash.com (fraud/scam)"; content:"|0d|explosioncash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fcrazy.com (kneber_zeus)"; content:"|06|fcrazy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file0129.iwillhavesexygirls.com (malware)"; content:"|08|file0129|12|iwillhavesexygirls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financial-groupco.tw (fraud)"; content:"|11|financial-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financial-groupco.ws (moneymule)"; content:"|11|financial-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financial-groupinc.tw (moneymule)"; content:"|12|financial-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financial-groupsvc.ws (moneymule)"; content:"|12|financial-groupsvc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firewallprotector.com (fraud/scam)"; content:"|11|firewallprotector|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivejet.com (trojan_fraudload)"; content:"|07|fivejet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivewjet.com (trojan_fraudload)"; content:"|08|fivewjet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fobsl.cn (kneber_zeus)"; content:"|05|fobsl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.d99q.cn (kneber_zeus)"; content:"|05|forum|04|d99q|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-limewire-now.com (fraud/scam)"; content:"|11|free-limewire-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fviejet.com (trojan_fraudload)"; content:"|07|fviejet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gatemx1.com (malware)"; content:"|07|gatemx1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerdas.cz (zbot)"; content:"|06|gerdas|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getdownloadmovies.com (fraud/scam)"; content:"|11|getdownloadmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gethotgames.com (fraud/scam)"; content:"|0b|gethotgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getlivebasketballtv.com (fraud/scam)"; content:"|13|getlivebasketballtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getlivefootballtv.com (fraud/scam)"; content:"|11|getlivefootballtv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getlivesoccertv.com (fraud/scam)"; content:"|0f|getlivesoccertv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getpcmovies.com (fraud/scam)"; content:"|0b|getpcmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gidrasil.cn (kneber_zeus)"; content:"|08|gidrasil|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalunitrack.com (malware)"; content:"|0e|globalunitrack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenmac.cn (kneber_zeus)"; content:"|09|goldenmac|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatan.cn (malware)"; content:"|07|greatan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenpl.com (kneber_zeus)"; content:"|07|greenpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadser.cz (zbot)"; content:"|06|hadser|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoploawq.com (malware)"; content:"|08|hoploawq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotmusicfast.com (fraud/scam)"; content:"|0c|hotmusicfast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hypnoticacolectiva.com (malware)"; content:"|12|hypnoticacolectiva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i-pspaccess.com (fraud/scam)"; content:"|0b|i-pspaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imoviedownloads.net (fraud/scam)"; content:"|0f|imoviedownloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info-bill.com (moneymule)"; content:"|09|info-bill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetdownloadstore.com (fraud/scam)"; content:"|15|internetdownloadstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isoftwaretv.com (fraud/scam)"; content:"|0b|isoftwaretv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itvdownload.com (fraud/scam)"; content:"|0b|itvdownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jioyfu.cz (zbot)"; content:"|06|jioyfu|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjotqkhqymp.info (malware)"; content:"|0b|jjotqkhqymp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jvoamkvyxv.info (malware)"; content:"|0a|jvoamkvyxv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k-litetk.com (fraud/scam)"; content:"|08|k-litetk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kamarilloskukarekas.com (malware)"; content:"|13|kamarilloskukarekas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kazz.com (fraud/scam)"; content:"|04|kazz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khalej.cn (kneber_zeus)"; content:"|06|khalej|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liulanqi.cc (malware)"; content:"|08|liulanqi|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lojasdiko.com (malware)"; content:"|09|lojasdiko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love2coffee.cn (kneber_zeus)"; content:"|0b|love2coffee|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicrevenue.com (fraud/scam)"; content:"|0c|magicrevenue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maglavais.ath.cx (malware)"; content:"|09|maglavais|03|ath|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mahjongmuseum.com (malware)"; content:"|0d|mahjongmuseum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mail2book.in (malware)"; content:"|09|mail2book|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maniyakat.cn (kneber_zeus)"; content:"|09|maniyakat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup market-vision.tw (fraud)"; content:"|0d|market-vision|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup market-visioninc.ws (fraud)"; content:"|10|market-visioninc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterpsp.com (fraud/scam)"; content:"|09|masterpsp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxpaidsurveys.com (fraud/scam)"; content:"|0e|maxpaidsurveys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup me-1.info (malware)"; content:"|04|me-1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup measure-groupco.tw (fraud)"; content:"|0f|measure-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup measure-groupco.ws (fraud)"; content:"|0f|measure-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup measure-groupinc.tw (fraud)"; content:"|10|measure-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup measure-groupinc.ws (fraud)"; content:"|10|measure-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medfinanceflow.com (fraud)"; content:"|0e|medfinanceflow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mevsimevsim.com (malware)"; content:"|0b|mevsimevsim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miamicaraccessories.com (malware)"; content:"|13|miamicaraccessories|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millennium-groupco.tw (fraud)"; content:"|12|millennium-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millennium-groupinc.ws (fraud)"; content:"|13|millennium-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millennium-groupsvc.tw (fraud)"; content:"|13|millennium-groupsvc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millennium-groupsvc.ws (fraud)"; content:"|13|millennium-groupsvc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monstersoftware.info (kneber_zeus)"; content:"|0f|monstersoftware|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviedownloadaccess.com (fraud/scam)"; content:"|13|moviedownloadaccess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviedownloadreview.biz (fraud/scam)"; content:"|13|moviedownloadreview|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviedownloadsnow.net (fraud/scam)"; content:"|11|moviedownloadsnow|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviesforpc.com (fraud/scam)"; content:"|0b|moviesforpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviewiz.net (fraud/scam)"; content:"|08|moviewiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3review.biz (fraud/scam)"; content:"|09|mp3review|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicplayer-downloads.com (fraud/scam)"; content:"|15|musicplayer-downloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicplayercenter.com (fraud/scam)"; content:"|11|musicplayercenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypspcenter.com (fraud/scam)"; content:"|0b|mypspcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywarworld.cn (kneber_zeus)"; content:"|0a|mywarworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myzunedownload.com (fraud/scam)"; content:"|0e|myzunedownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nautiqa.com.sg (malware)"; content:"|07|nautiqa|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neswbrand.com (malware)"; content:"|09|neswbrand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netpaidshopping.com (fraud/scam)"; content:"|0f|netpaidshopping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmovieflicks.com (fraud/scam)"; content:"|0e|newmovieflicks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nit99.biz (kneber_zeus)"; content:"|05|nit99|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nmalodbp.com (kneber_zeus)"; content:"|08|nmalodbp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noltvoqmhoce.info (malware)"; content:"|0c|noltvoqmhoce|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuris-groupco.tw (fraud)"; content:"|0d|nuris-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuris-groupco.ws (fraud)"; content:"|0d|nuris-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuris-groupinc.tw (moneymule)"; content:"|0e|nuris-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuris-groupinc.ws (fraud)"; content:"|0e|nuris-groupinc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvbgfy.cz (zbot)"; content:"|06|nvbgfy|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup order-info.com (fraud)"; content:"|0a|order-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pasder.cz (zbot)"; content:"|06|pasder|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patrickcadona.com (malware)"; content:"|0d|patrickcadona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pedersii.net (kneber_zeus)"; content:"|08|pedersii|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playtodayss.net (malware)"; content:"|0b|playtodayss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pmxjpigimsdv.info (malware)"; content:"|0c|pmxjpigimsdv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proadware.com (fraud/scam)"; content:"|09|proadware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qooglesearch.com (malware)"; content:"|0c|qooglesearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r7n7.com (malware)"; content:"|04|r7n7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup render-groupco.tw (moneymule)"; content:"|0e|render-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup render-groupco.ws (moneymule)"; content:"|0e|render-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup render-groupinc.tw (moneymule)"; content:"|0f|render-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1030.co.uk (fastflux)"; content:"|07|rep1030|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1030.me.uk (fastflux)"; content:"|07|rep1030|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1031.co.uk (fastflux)"; content:"|07|rep1031|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1032.co.uk (fastflux)"; content:"|07|rep1032|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1041.co.uk (fastflux)"; content:"|07|rep1041|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1041.me.uk (fastflux)"; content:"|07|rep1041|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1042.co.uk (fastflux)"; content:"|07|rep1042|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1042.me.uk (fastflux)"; content:"|07|rep1042|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1043.co.uk (fastflux)"; content:"|07|rep1043|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rep1043.me.uk (fastflux)"; content:"|07|rep1043|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ricksmusicstore.com (malware)"; content:"|0f|ricksmusicstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ro777.com (malware)"; content:"|05|ro777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rocklamanna.com (malware)"; content:"|0b|rocklamanna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rolstop.in (malware)"; content:"|07|rolstop|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safepcav.com (malware)"; content:"|08|safepcav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.info-bill.com (fraud)"; content:"|06|secure|09|info-bill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.order-info.com (fraud)"; content:"|06|secure|0a|order-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server.modulo03.com (malware)"; content:"|06|server|08|modulo03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shareazasite.com (fraud/scam)"; content:"|0c|shareazasite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sowner.info (malware)"; content:"|06|sowner|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sttcounter.cn (kneber_zeus)"; content:"|0a|sttcounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success-groupco.tw (moneymule)"; content:"|0f|success-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success-groupco.ws (moneymule)"; content:"|0f|success-groupco|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success-groupinc.tw (moneymule)"; content:"|10|success-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup success-groupsvc.ws (moneymule)"; content:"|10|success-groupsvc|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxsimple.us (malware)"; content:"|09|taxsimple|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tbxierkoqze.info (malware)"; content:"|0b|tbxierkoqze|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technotronics.cn (malware)"; content:"|0d|technotronics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theshipmangroup.com (malware)"; content:"|0f|theshipmangroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top4hot.info (malware)"; content:"|07|top4hot|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udaswy.cz (zbot)"; content:"|06|udaswy|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uijghy.cz (zbot)"; content:"|06|uijghy|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vexmarc.com (fraud)"; content:"|07|vexmarc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scannerdot1.com (malware)"; content:"|11|virus-scannerdot1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scannerdot2.com (malware)"; content:"|11|virus-scannerdot2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scannerdot3.com (malware)"; content:"|11|virus-scannerdot3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scannerdot6.com (malware)"; content:"|11|virus-scannerdot6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vjxzzqobsyz.com (malware)"; content:"|0b|vjxzzqobsyz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-pings.com (malware)"; content:"|09|web-pings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welovetweet.com (malware)"; content:"|0b|welovetweet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wordpressquest.com (malspam)"; content:"|0e|wordpressquest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wxrzufdrzzn.info (malware)"; content:"|0b|wxrzufdrzzn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xenonshow.gr (malware)"; content:"|09|xenonshow|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xlgjewczfjqx.com (malware)"; content:"|0c|xlgjewczfjqx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpresscanon-yourpc.com (rogue)"; content:"|12|xpresscanon-yourpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxcamerasexcheap.com (exploit)"; content:"|11|xxxcamerasexcheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yuferd.cz (zbot)"; content:"|06|yuferd|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z130217.infobox.ru (malware)"; content:"|07|z130217|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zontrhost.net (malware)"; content:"|09|zontrhost|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoo-account-services.com (malware)"; content:"|16|yahoo-account-services|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbestmarket.com (malware)"; content:"|0e|yourbestmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvuxksuk.cn (malware)"; content:"|08|yvuxksuk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0ci.ru (trojan)"; content:"|03|0ci|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1class-antispyware.com (fastflux)"; content:"|12|1class-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1classantispyware.com (fastflux)"; content:"|11|1classantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1classantispywarec.com (fastflux)"; content:"|12|1classantispywarec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1classantispywared.com (fastflux)"; content:"|12|1classantispywared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-antivirus-scana.com (fastflux)"; content:"|14|2010-antivirus-scana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-antivirus-scanh.com (fastflux)"; content:"|14|2010-antivirus-scanh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-antivirus-scanm.com (fastflux)"; content:"|14|2010-antivirus-scanm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-antivirus-scann.com (fastflux)"; content:"|14|2010-antivirus-scann|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2010-antivirus-scanv.com (fastflux)"; content:"|14|2010-antivirus-scanv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7-job-net.com (fraud)"; content:"|09|7-job-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aboutrevers.com (zeus/wsnpoem)"; content:"|0b|aboutrevers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acb.bs.it (trojan)"; content:"|03|acb|02|bs|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adjamadja.cn (malware)"; content:"|09|adjamadja|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-security1.com (fastflux)"; content:"|11|antispy-security1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-security3.com (fastflux)"; content:"|11|antispy-security3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-security5.com (fastflux)"; content:"|11|antispy-security5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-security7.com (fastflux)"; content:"|11|antispy-security7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anywayi.info (trojan)"; content:"|07|anywayi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup articlesi.info (trojan)"; content:"|09|articlesi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availablemediamore.com (trojan)"; content:"|12|availablemediamore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bert8ihd.net (trojan)"; content:"|08|bert8ihd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfreedns.in (malware)"; content:"|0b|bestfreedns|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsysprotection.in (trojan)"; content:"|11|bestsysprotection|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizcontax.co.za (koobface)"; content:"|09|bizcontax|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogsnstuff.com (koobface)"; content:"|0b|blogsnstuff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bowwow.co.in (exploits )"; content:"|06|bowwow|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brevard-fl.com (koobface)"; content:"|0a|brevard-fl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bustedsafer.cn (exploit)"; content:"|0b|bustedsafer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cafeinternationalcatering.com (koobface)"; content:"|19|cafeinternationalcatering|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cekc2.com (zeus/wsnpoem)"; content:"|05|cekc2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup company-euro.com (fraud)"; content:"|0c|company-euro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpadm21.org (zeus/wsnpoem)"; content:"|07|cpadm21|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpu-help-online.info (rogue)"; content:"|0f|cpu-help-online|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cqb-inc.com (trojan)"; content:"|07|cqb-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dedicalsels.com (zeus)"; content:"|0b|dedicalsels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derryrailtrail.org (koobface)"; content:"|0e|derryrailtrail|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deserver.dnsdojo.net (zeus/wsnpoem)"; content:"|08|deserver|07|dnsdojo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dixon-link.com (malware)"; content:"|0a|dixon-link|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsresourcecenter.com (c&c)"; content:"|11|dnsresourcecenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dosuguss.net (c&c)"; content:"|08|dosuguss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euro-shopping.net (fraud)"; content:"|0d|euro-shopping|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold-es-net.com (fraud)"; content:"|0b|gold-es-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldes-it.com (fraud)"; content:"|09|goldes-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup good-nets.com (fraud)"; content:"|09|good-nets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guard-lab.net (rogue)"; content:"|09|guard-lab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gxf.co.il (koobface)"; content:"|03|gxf|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happyhardcoreporn.com (exploit)"; content:"|11|happyhardcoreporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horosta1.ru (zeus/wsnpoem)"; content:"|08|horosta1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inet-guard.net (rogue)"; content:"|0a|inet-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inetguard2.net (rogue)"; content:"|0a|inetguard2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inetguardlab.net (rogue)"; content:"|0c|inetguardlab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inguards.net (rogue)"; content:"|08|inguards|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel-z1-antispyware.com (fastflux)"; content:"|14|intel-z1-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel-z3-antispyware.com (fastflux)"; content:"|14|intel-z3-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel-z5-antispyware.com (fastflux)"; content:"|14|intel-z5-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel-z6-antispyware.com (fastflux)"; content:"|14|intel-z6-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel-z7-antispyware.com (fastflux)"; content:"|14|intel-z7-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel1-antivirus.com (fastflux)"; content:"|10|intel1-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel3-antivirus.com (fastflux)"; content:"|10|intel3-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel5-antivirus.com (fastflux)"; content:"|10|intel5-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel7-antivirus.com (fastflux)"; content:"|10|intel7-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intel9-antivirus.com (fastflux)"; content:"|10|intel9-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internethosting.sg (koobface)"; content:"|0f|internethosting|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-financess.com (fraud)"; content:"|0c|it-financess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup job-for-yours.com (fraud)"; content:"|0d|job-for-yours|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justproud2b.com (koobface)"; content:"|0b|justproud2b|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l2tops.msk.ru (exploit)"; content:"|06|l2tops|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionelsorin.fr (trojan)"; content:"|0b|lionelsorin|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liturile.ru (zeus/wsnpoem)"; content:"|08|liturile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesoftrock.com (rogue)"; content:"|0c|livesoftrock|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lokal.enhedslisten.dk (phishing )"; content:"|05|lokal|0c|enhedslisten|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazeratis.com (bot)"; content:"|09|mazeratis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-scanner.com (fastflux)"; content:"|0d|mega1-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega2-scanner.com (fastflux)"; content:"|0d|mega2-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega4-scanner.com (fastflux)"; content:"|0d|mega4-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega6-scanner.com (fastflux)"; content:"|0d|mega6-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega7-scanner.com (fastflux)"; content:"|0d|mega7-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro1soft-scanner.com (fastflux)"; content:"|12|micro1soft-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro2soft-scanner.com (fastflux)"; content:"|12|micro2soft-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro4soft-scanner.com (fastflux)"; content:"|12|micro4soft-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro6soft-scanner.com (fastflux)"; content:"|12|micro6soft-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro7soft-scanner.com (fastflux)"; content:"|12|micro7soft-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missboston.org (trojan)"; content:"|0a|missboston|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoprotection-scan01.com (fastflux)"; content:"|15|nanoprotection-scan01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoprotection-scan02.com (fastflux)"; content:"|15|nanoprotection-scan02|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoprotection-scan04.com (fastflux)"; content:"|15|nanoprotection-scan04|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoprotection-scan07.com (fastflux)"; content:"|15|nanoprotection-scan07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanoprotection-scan09.com (fastflux)"; content:"|15|nanoprotection-scan09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup navigate777.net (zeus/wsnpoem)"; content:"|0b|navigate777|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newcarsdot.biz (c&c)"; content:"|0a|newcarsdot|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newcrawler.cn (rogue)"; content:"|0a|newcrawler|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgen-scannerb.com (fastflux)"; content:"|10|nextgen-scannerb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgen-scannerc.com (fastflux)"; content:"|10|nextgen-scannerc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgen-scannerd.com (fastflux)"; content:"|10|nextgen-scannerd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgen-scannerr.com (fastflux)"; content:"|10|nextgen-scannerr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextgen-scannert.com (fastflux)"; content:"|10|nextgen-scannert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niposedas.ru (zeus/wsnpoem)"; content:"|09|niposedas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitro-antispyware.com (fastflux)"; content:"|11|nitro-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitro-antispywarea.com (fastflux)"; content:"|12|nitro-antispywarea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitro-antispywarec.com (fastflux)"; content:"|12|nitro-antispywarec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitro-antispywared.com (fastflux)"; content:"|12|nitro-antispywared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitro-antispywaret.com (fastflux)"; content:"|12|nitro-antispywaret|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nolif3-clan.net (exploit)"; content:"|0b|nolif3-clan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntmeda.org (zeus/wsnpoem)"; content:"|06|ntmeda|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olypoos.com (zeus/wsnpoem)"; content:"|07|olypoos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-web-net.com (fraud)"; content:"|0e|online-web-net|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oppiomna.com (trojan)"; content:"|08|oppiomna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outoffinternet.info (zeus/wsnpoem)"; content:"|0e|outoffinternet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oyunland.org (exploits )"; content:"|08|oyunland|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup people-and-job.net (fraud)"; content:"|0e|people-and-job|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peyamnetsd.info (trojan)"; content:"|0a|peyamnetsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phiesookaeruaxah.in (exploits )"; content:"|10|phiesookaeruaxah|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picula.ru (zeus/wsnpoem)"; content:"|06|picula|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playbosssiks.net (zeus/wsnpoem)"; content:"|0c|playbosssiks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poolst.in (zeus/wsnpoem)"; content:"|06|poolst|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup probestclub.com (fastflux)"; content:"|0b|probestclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection11scan.com (fastflux)"; content:"|10|protection11scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection12scan.com (fastflux)"; content:"|10|protection12scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection14scan.com (fastflux)"; content:"|10|protection14scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection15scan.com (fastflux)"; content:"|10|protection15scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection18scan.com (fastflux)"; content:"|10|protection18scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purgand.com (fastflux)"; content:"|07|purgand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick0-antivirus-scan.com (fastflux)"; content:"|15|quick0-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick2-antivirus-scan.com (fastflux)"; content:"|15|quick2-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick4-antivirus-scan.com (fastflux)"; content:"|15|quick4-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redsol.cn (rogue)"; content:"|06|redsol|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retranslate.org (zeus/wsnpoem)"; content:"|0b|retranslate|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richardspizza.com (koobface)"; content:"|0d|richardspizza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rschaedeli.dyndns.org (koobface)"; content:"|0a|rschaedeli|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run1-antivirus-scan.com (fastflux)"; content:"|13|run1-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run3-antivirus-scan.com (fastflux)"; content:"|13|run3-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run5-antivirus-scan.com (fastflux)"; content:"|13|run5-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run7-antivirus-scan.com (fastflux)"; content:"|13|run7-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run9-antivirus-scan.com (fastflux)"; content:"|13|run9-antivirus-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s-domain.cn (zeus/wsnpoem)"; content:"|08|s-domain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s172760532.onlinehome.us (koobface)"; content:"|0a|s172760532|0a|onlinehome|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanvirtek.com (trojan)"; content:"|0a|scanvirtek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-scanner.in (trojan)"; content:"|0e|secure-scanner|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheenalarsen.com (koobface)"; content:"|0c|sheenalarsen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slashrock.info (malware)"; content:"|09|slashrock|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softforwin25.com (zeus/wsnpoem)"; content:"|0c|softforwin25|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sp-777.com (phishing )"; content:"|06|sp-777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopwarsintheworld.com (zeus/wsnpoem)"; content:"|12|stopwarsintheworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup straks.fr (trojan)"; content:"|06|straks|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susez.mine.nu (zeus/wsnpoem)"; content:"|05|susez|04|mine|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemrestoreupdate.com (trojan)"; content:"|13|systemrestoreupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tchetik.phpnet.us (trojan)"; content:"|07|tchetik|06|phpnet|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempr.ru (zeus/wsnpoem)"; content:"|05|tempr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup texasref.com (koobface)"; content:"|08|texasref|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup transport96.ru (zeus/wsnpoem)"; content:"|0b|transport96|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turningout.cn (rogue)"; content:"|0a|turningout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uaetoon.net (koobface)"; content:"|07|uaetoon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup univi.chez.com (exploits )"; content:"|05|univi|04|chez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-scannerdot7.com (fastflux)"; content:"|11|virus-scannerdot7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volosanka.cn (bot)"; content:"|09|volosanka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waimaighaiphahxi.in (exploits )"; content:"|10|waimaighaiphahxi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-euro-it.com (fraud)"; content:"|0b|web-euro-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webcompany-es.net (fraud)"; content:"|0d|webcompany-es|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webcompany-euro.net (fraud)"; content:"|0f|webcompany-euro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webfiless.com (fraud)"; content:"|09|webfiless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpages-it.com (fraud)"; content:"|0b|webpages-it|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wesst-es.net (fraud)"; content:"|08|wesst-es|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wesst-netts.com (fraud)"; content:"|0b|wesst-netts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwwtrue.org (zeus/wsnpoem)"; content:"|07|wwwtrue|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyx.wfu.edu.cn (malware)"; content:"|03|yyx|03|wfu|03|edu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestworldparty.cn (harmful)"; content:"|11|thebestworldparty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 27gr.co.tv (zeus/wsnpoem)"; content:"|04|27gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 34jh7alm94.asia (rootkit)"; content:"|0a|34jh7alm94|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 873hgf7xx60.com (rootkit)"; content:"|0b|873hgf7xx60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 88810.cn (malware)"; content:"|05|88810|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 953333.com (malware)"; content:"|06|953333|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2132959.0lx.net (malware)"; content:"|08|a2132959|03|0lx|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abouttraffic.net (malware)"; content:"|0c|abouttraffic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdbxybadve.com (malware)"; content:"|0b|acdbxybadve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aprotect.com (malware)"; content:"|08|aprotect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arraysaw.com (malicious)"; content:"|08|arraysaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arraysaw.net (malicious)"; content:"|08|arraysaw|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arshard.com (malware)"; content:"|07|arshard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autoparck.sumy.ua (zeus/wsnpoem)"; content:"|09|autoparck|04|sumy|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-command.com (rogue)"; content:"|0a|av-command|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcommand.net (malicious)"; content:"|09|avcommand|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviavavilons.net (exploit)"; content:"|0c|aviavavilons|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b11335599.cn (rootkit)"; content:"|09|b11335599|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basiscause.com (zeus/wsnpoem)"; content:"|0a|basiscause|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botproxy2.twoblocksdown.com (zeus/wsnpoem)"; content:"|09|botproxy2|0d|twoblocksdown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brozsearch.com (malware)"; content:"|0a|brozsearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessboard6124.net (zeus/wsnpoem)"; content:"|11|businessboard6124|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c36996639.cn (rootkit)"; content:"|09|c36996639|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c58446658.cn (rootkit)"; content:"|09|c58446658|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canadauniversitypress.com (exploits)"; content:"|15|canadauniversitypress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup candyshop451.com (zeus/wsnpoem)"; content:"|0c|candyshop451|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cavally.in (malware)"; content:"|07|cavally|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contempt.in (malware)"; content:"|08|contempt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contentserver.ru (malware)"; content:"|0d|contentserver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contrsnid.uz.ua (exploit)"; content:"|09|contrsnid|02|uz|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d92378523.cn (malware)"; content:"|09|d92378523|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup didbotta6.unipv.it (malware)"; content:"|09|didbotta6|05|unipv|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup disea.info (malware)"; content:"|05|disea|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup draft5sticks4.net (rogue)"; content:"|0d|draft5sticks4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebaat.biz (rogue)"; content:"|05|ebaat|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egn14142nn.ws (rootkit)"; content:"|0a|egn14142nn|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egygate.info (malware)"; content:"|07|egygate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enteri1llisec.in (rogue)"; content:"|0d|enteri1llisec|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evertrands.com (exploitkit)"; content:"|0a|evertrands|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everybots.com (malware)"; content:"|09|everybots|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup experrior.eu (zeus/wsnpoem)"; content:"|09|experrior|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findlostcats.com (zeus/wsnpoem)"; content:"|0c|findlostcats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplayerpluginonline.com (trojan)"; content:"|17|flashplayerpluginonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup footbal.rv.ua (zeus)"; content:"|07|footbal|02|rv|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-screen-capture-software.com (malware)"; content:"|1c|free-screen-capture-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeanalsextubemovies.com (rogue)"; content:"|15|freeanalsextubemovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fructik3.ru (exploit)"; content:"|08|fructik3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gameshort.ru (bot)"; content:"|09|gameshort|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geo95.com (backdoor)"; content:"|05|geo95|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getsup.info (malware)"; content:"|06|getsup|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globostep.info (rogue)"; content:"|09|globostep|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleanalinics.com (zeus/wsnpoem)"; content:"|0f|googleanalinics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleinru.in (malware)"; content:"|0a|googleinru|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotnewfriendbook.com (rogue)"; content:"|10|gotnewfriendbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gromz.net (exploit)"; content:"|05|gromz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happytreeporno.com (exploitkit)"; content:"|0e|happytreeporno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeamateurclips.com (malware)"; content:"|10|homeamateurclips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesitetoo.com (zeus/wsnpoem)"; content:"|0b|homesitetoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqexgirl.osa.pl (rogue)"; content:"|08|hqexgirl|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iescrow.ir (zeus/wsnpoem)"; content:"|07|iescrow|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illegaloffer.ru (malware)"; content:"|0c|illegaloffer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imobiliariacanela.com.br (trojan)"; content:"|11|imobiliariacanela|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j00k877x.cc (rootkit)"; content:"|08|j00k877x|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaliuz.com (harmful)"; content:"|06|kaliuz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolaider.net (rogue)"; content:"|08|kolaider|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kozzz.in (exploit)"; content:"|05|kozzz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lmaoimages.com (malware)"; content:"|0a|lmaoimages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m2121212.cn (rootkit)"; content:"|08|m2121212|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m3131313.cn (rootkit)"; content:"|08|m3131313|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miamiheraldsi.com (malware)"; content:"|0d|miamiheraldsi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mn8873nb01.cc (rootkit)"; content:"|0a|mn8873nb01|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup natos.info (malware)"; content:"|05|natos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbsolution.com (malware)"; content:"|0a|nbsolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nn31415en.in (rootkit)"; content:"|09|nn31415en|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oast.com (malware)"; content:"|04|oast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personalsystemscan.cn (malware)"; content:"|12|personalsystemscan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plainjapan.com (malware)"; content:"|0a|plainjapan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playthisfuck.com (attack_site)"; content:"|0c|playthisfuck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polevand.com (-)"; content:"|08|polevand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polycounter.com (malware)"; content:"|0b|polycounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pzignbfxspou.info (exploit)"; content:"|0c|pzignbfxspou|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickmedialinks.com (malicious)"; content:"|0f|quickmedialinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redondo.ru (zeus/wsnpoem)"; content:"|07|redondo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redriveruk.com (malicious)"; content:"|0a|redriveruk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilka.co.kr (fastflux)"; content:"|06|reilka|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilka.kr (fastflux)"; content:"|06|reilka|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilki.co.kr (fastflux)"; content:"|06|reilki|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilki.kr (fastflux)"; content:"|06|reilki|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilki.ne.kr (fastflux)"; content:"|06|reilki|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilki.or.kr (fastflux)"; content:"|06|reilki|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilko.co.kr (fastflux)"; content:"|06|reilko|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilko.kr (fastflux)"; content:"|06|reilko|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilko.ne.kr (fastflux)"; content:"|06|reilko|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reilkx.or.kr (fastflux)"; content:"|06|reilkx|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rioner.com (zeus/wsnpoem)"; content:"|06|rioner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salamangzan.com (c&c)"; content:"|0b|salamangzan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santacruzinfo.com.br (malware)"; content:"|0d|santacruzinfo|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerborn.cn (rootkit)"; content:"|0a|scanerborn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scoregame.info (zeus/wsnpoem)"; content:"|09|scoregame|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchfeature.org (trojan)"; content:"|0d|searchfeature|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sendingout.cn (rootkit)"; content:"|0a|sendingout|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sendspace.repek.or.kr (exploit)"; content:"|09|sendspace|05|repek|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serdb01.com (malware)"; content:"|07|serdb01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shitstream.cn (malware)"; content:"|0a|shitstream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slinkadult.biz (exploitkit)"; content:"|0a|slinkadult|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smile.if.ua (zeus/wsnpoem)"; content:"|05|smile|02|if|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softinternational.net (malware)"; content:"|11|softinternational|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportgun.pl.ua (neosploiy)"; content:"|08|sportgun|02|pl|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stignita.zapto.org (zeus/wsnpoem)"; content:"|08|stignita|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stoptibetcrisis.net (malicious)"; content:"|0f|stoptibetcrisis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storage84030.org (zeus/wsnpoem)"; content:"|0c|storage84030|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunqtr.com (malware)"; content:"|06|sunqtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabs.pl (malware)"; content:"|04|tabs|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsstdstds.org (rogue)"; content:"|0a|tdsstdstds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theinputonline.com (malware)"; content:"|0e|theinputonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetubeholder.com (trojanan)"; content:"|0d|thetubeholder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uncutsouthmovies.com (rogue)"; content:"|10|uncutsouthmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updategr.org (skypespam)"; content:"|08|updategr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valentinsss.info (zeus/wsnpoem)"; content:"|0b|valentinsss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whyviral.com (malware)"; content:"|08|whyviral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woodfuelwales.com (exploitkit)"; content:"|0d|woodfuelwales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup www-myphoto.com (trojan)"; content:"|0b|www-myphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-drugs.ru (zeus/wsnpoem)"; content:"|07|x-drugs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x21526.nb.host192-168-1-2.com (malware)"; content:"|06|x21526|02|nb|0f|host192-168-1-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxtoywebsitecheap.com (malware)"; content:"|12|xxxtoywebsitecheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yswzrjkpsp.com (rogue)"; content:"|0a|yswzrjkpsp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeroday.cc (malware)"; content:"|07|zeroday|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 15gr.co.tv (zeus)"; content:"|04|15gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 16gr.co.tv (zeus)"; content:"|04|16gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 99999pk.com (malware)"; content:"|07|99999pk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2zthings.com (malvertisment)"; content:"|09|a2zthings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaafreebarter.com (malvertisment)"; content:"|0d|aaafreebarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabtiktadve.com (malvertisment)"; content:"|0b|aabtiktadve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abxbarter.com (malvertisment)"; content:"|09|abxbarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdlsmladve.com (malvertisment)"; content:"|0b|acdlsmladve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdlsvladve.com (malvertisment)"; content:"|0b|acdlsvladve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aozjuvcbkupv.info (malvertisment)"; content:"|0c|aozjuvcbkupv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-crew.net (malvertisment)"; content:"|07|av-crew|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-protect.com (malvertisment)"; content:"|0a|av-protect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avgroupwebsite.com (malvertisment)"; content:"|0e|avgroupwebsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azisugftqguq.com (malvertisment)"; content:"|0c|azisugftqguq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backupzzz.com (zeus)"; content:"|09|backupzzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barteranywhere.com (malvertisment)"; content:"|0e|barteranywhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterbam.com (malvertisment)"; content:"|09|barterbam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterbing.com (malvertisment)"; content:"|0a|barterbing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterbrokersusa.com (malvertisment)"; content:"|10|barterbrokersusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterbucks.us (malvertisment)"; content:"|0b|barterbucks|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterbureau.com (malvertisment)"; content:"|0c|barterbureau|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bartercontrol.com (malvertisment)"; content:"|0d|bartercontrol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterforbusiness.com (malvertisment)"; content:"|11|barterforbusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterforbusiness.net (malvertisment)"; content:"|11|barterforbusiness|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bartergenius.com (malvertisment)"; content:"|0c|bartergenius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterne.com (malvertisment)"; content:"|08|barterne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barternewengland.com (malvertisment)"; content:"|10|barternewengland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barterofsandiego.com (malvertisment)"; content:"|10|barterofsandiego|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bazqrhafrrh.info (malvertisment)"; content:"|0b|bazqrhafrrh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bidxctvqvwrw.info (malvertisment)"; content:"|0c|bidxctvqvwrw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biz2bizcommerce.com (malvertisment)"; content:"|0f|biz2bizcommerce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonescaner.cn (malware)"; content:"|0a|bonescaner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byuigracdnjj.info (malvertisment)"; content:"|0c|byuigracdnjj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capitolbartering.net (malvertisment)"; content:"|10|capitolbartering|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfnmmoviesman.com (malware)"; content:"|0d|cfnmmoviesman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cgnmydalqgsm.com (malvertisment)"; content:"|0c|cgnmydalqgsm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charitybarterbanc.org (malvertisment)"; content:"|11|charitybarterbanc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charitycashlessbanc.com (malvertisment)"; content:"|13|charitycashlessbanc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charitytradebanc.org (malvertisment)"; content:"|10|charitytradebanc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckzqfrxaxihi.info (malvertisment)"; content:"|0c|ckzqfrxaxihi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comunicat-de-presa.ro (malware)"; content:"|12|comunicat-de-presa|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contecomigo.net.br (threat)"; content:"|0b|contecomigo|03|net|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corexchange.org (malvertisment)"; content:"|0b|corexchange|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corporatebarteronline.com (malvertisment)"; content:"|15|corporatebarteronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cvybexpnqhlx.info (malvertisment)"; content:"|0c|cvybexpnqhlx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxdnvwapzezk.info (malvertisment)"; content:"|0c|cxdnvwapzezk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbcavsaddve.com (malvertisment)"; content:"|0b|dbcavsaddve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbvvwrkgycfa.info (malvertisment)"; content:"|0c|dbvvwrkgycfa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dcghkoixsagu.info (malvertisment)"; content:"|0c|dcghkoixsagu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddehkyhddve.com (malvertisment)"; content:"|0b|ddehkyhddve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddewphwddve.com (malvertisment)"; content:"|0b|ddewphwddve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desz.kr (phishing)"; content:"|04|desz|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desz.ne.kr (phishing)"; content:"|04|desz|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desz.or.kr (phishing)"; content:"|04|desz|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dffmjefhfyf.com (malvertisment)"; content:"|0b|dffmjefhfyf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfxlhdyffzho.info (malvertisment)"; content:"|0c|dfxlhdyffzho|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djxyazxjpfnf.info (malvertisment)"; content:"|0c|djxyazxjpfnf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doapost.com (malvertisment)"; content:"|07|doapost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dobarter.com (malvertisment)"; content:"|08|dobarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dobarter.darnfast.net (malvertisment)"; content:"|08|dobarter|08|darnfast|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwldxeqavts.info (malvertisment)"; content:"|0b|dwldxeqavts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dygpcewrjnw.info (malvertisment)"; content:"|0b|dygpcewrjnw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edaddywarbucks.net (malvertisment)"; content:"|0e|edaddywarbucks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edase.or.kr (phishing)"; content:"|05|edase|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eliyisgtkaj.info (malvertisment)"; content:"|0b|eliyisgtkaj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emo-lesbians.com (malware)"; content:"|0c|emo-lesbians|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersm.kr (phishing)"; content:"|04|ersm|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ersm.ne.kr (phishing)"; content:"|04|ersm|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eututrywxvhd.info (malvertisment)"; content:"|0c|eututrywxvhd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellencesoft.com (malware)"; content:"|0e|excellencesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezqaxnmsbs.info (malvertisment)"; content:"|0a|ezqaxnmsbs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friavuzpsvxc.info (malvertisment)"; content:"|0c|friavuzpsvxc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fywthroeasx.info (malvertisment)"; content:"|0b|fywthroeasx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogle-analiz.com (malware)"; content:"|0c|gogle-analiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analitics.net (exploit)"; content:"|10|google-analitics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleinrus.in (harmful)"; content:"|0b|googleinrus|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopbaqvgprvh.info (malvertisment)"; content:"|0c|gopbaqvgprvh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjvcnunmtzc.info (malvertisment)"; content:"|0b|hjvcnunmtzc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hnstetlseuop.info (malvertisment)"; content:"|0c|hnstetlseuop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup host192-168-1-2.com (malware)"; content:"|0f|host192-168-1-2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hwqckfphkhyi.com (malvertisment)"; content:"|0c|hwqckfphkhyi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hzlyaejcvmat.info (malvertisment)"; content:"|0c|hzlyaejcvmat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibabiz.com (malvertisment)"; content:"|06|ibabiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iipghhbnarh.com (malvertisment)"; content:"|0b|iipghhbnarh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikbalvockal.net (zeus)"; content:"|0b|ikbalvockal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inxvwrxogrc.info (malvertisment)"; content:"|0b|inxvwrxogrc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j80-trinitains.com (malware)"; content:"|0e|j80-trinitains|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbaagpepjvc.com (malvertisment)"; content:"|0b|jbaagpepjvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jestywtvadgj.info (malvertisment)"; content:"|0c|jestywtvadgj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgvsjnhmvngn.info (malvertisment)"; content:"|0c|jgvsjnhmvngn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jklnznqvztu.info (malvertisment)"; content:"|0b|jklnznqvztu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jttyhhvcxmbz.info (malvertisment)"; content:"|0c|jttyhhvcxmbz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kijksoeohxze.info (malvertisment)"; content:"|0c|kijksoeohxze|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kmpbfdtknwsh.info (malvertisment)"; content:"|0c|kmpbfdtknwsh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kzpkpehthbgn.info (malvertisment)"; content:"|0c|kzpkpehthbgn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lbckqbkldve.com (malvertisment)"; content:"|0b|lbckqbkldve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leadingedgetrade.com (malvertisment)"; content:"|10|leadingedgetrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup learningomaha.com (malware)"; content:"|0d|learningomaha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limeakfjskt.com (malvertisment)"; content:"|0b|limeakfjskt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-soft.net (malvertisment)"; content:"|09|live-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsvoenxxyya.info (malvertisment)"; content:"|0b|lsvoenxxyya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mad-millions.biz (malware)"; content:"|0c|mad-millions|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malibuexchange.com (malvertisment)"; content:"|0e|malibuexchange|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashburnsales.com (malware)"; content:"|0d|mashburnsales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxcardinc.com (malvertisment)"; content:"|0a|maxcardinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mkmohanty.com (malware)"; content:"|09|mkmohanty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnuzqxerjufm.info (malvertisment)"; content:"|0c|mnuzqxerjufm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mohammedistechnologies.com (malware)"; content:"|16|mohammedistechnologies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muhrlwuzyaly.info (malvertisment)"; content:"|0c|muhrlwuzyaly|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myunionwallet.com (malware)"; content:"|0d|myunionwallet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naturecoastbarter.com (malvertisment)"; content:"|11|naturecoastbarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbtislvidmq.info (malvertisment)"; content:"|0b|nbtislvidmq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-soft.net (malvertisment)"; content:"|08|new-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news.hermison.com (malware)"; content:"|04|news|08|hermison|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoftcore.com (malvertisment)"; content:"|0b|newsoftcore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsoftspot.com (malvertisment)"; content:"|0b|newsoftspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nlfgjehbotwi.info (malvertisment)"; content:"|0c|nlfgjehbotwi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyqoxifkvxga.com (malvertisment)"; content:"|0c|nyqoxifkvxga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oaofmsckue.info (malvertisment)"; content:"|0a|oaofmsckue|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocryspyjvkh.info (malvertisment)"; content:"|0b|ocryspyjvkh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oiav84.ru (malware)"; content:"|06|oiav84|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omvdbdcknpct.info (malvertisment)"; content:"|0c|omvdbdcknpct|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oneofakindsxm.com (malware)"; content:"|0d|oneofakindsxm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orangebeemoney.com (malvertisment)"; content:"|0e|orangebeemoney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottawabarter.com (malvertisment)"; content:"|0c|ottawabarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup papirosi.info (malware)"; content:"|08|papirosi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pavel.real-host.ru (malware)"; content:"|05|pavel|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pdecaxcpdve.com (malware)"; content:"|0b|pdecaxcpdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfect-center.org (malware)"; content:"|0e|perfect-center|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfgtihtpdve.com (malvertisment)"; content:"|0b|pfgtihtpdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pghtradealliance.com (malvertisment)"; content:"|10|pghtradealliance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pianwinpdve.com (malvertisment)"; content:"|0b|pianwinpdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pianwxnpdve.com (malvertisment)"; content:"|0b|pianwxnpdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pittsburgh-trade-alliance.com (malvertisment)"; content:"|19|pittsburgh-trade-alliance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platinumtraders.com.au (malvertisment)"; content:"|0f|platinumtraders|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portablapps.info (zeus)"; content:"|0b|portablapps|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premierbarter.com (malvertisment)"; content:"|0d|premierbarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prtrkmxkpctw.info (malvertisment)"; content:"|0c|prtrkmxkpctw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puddxvixrro.com (malvertisment)"; content:"|0b|puddxvixrro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qabtihtqdve.com (malvertisment)"; content:"|0b|qabtihtqdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcdvnhvqdve.com (malvertisment)"; content:"|0b|qcdvnhvqdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjiwptwqdve.com (malvertisment)"; content:"|0b|qjiwptwqdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlcleaner.eu (malware)"; content:"|09|qlcleaner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlgkmytdvyjx.info (malvertisment)"; content:"|0c|qlgkmytdvyjx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retdownload.info (malware)"; content:"|0b|retdownload|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ricardocarvalho.co.za (malware)"; content:"|0f|ricardocarvalho|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rimofoixaf.info (malvertisment)"; content:"|0a|rimofoixaf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ritmotours.com.tr (malware)"; content:"|0a|ritmotours|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riupdate.info (malware)"; content:"|08|riupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmkbyklbhawd.info (malvertisment)"; content:"|0c|rmkbyklbhawd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roomservicedesign.com.au (malware)"; content:"|11|roomservicedesign|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalautomodule.in (malware)"; content:"|0f|royalautomodule|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalsearch.org (malware)"; content:"|0b|royalsearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtkffbmmgkpw.info (malvertisment)"; content:"|0c|rtkffbmmgkpw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxflhciirups.info (malvertisment)"; content:"|0c|rxflhciirups|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salefale.com (exploit)"; content:"|08|salefale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerexcuse.cn (malware)"; content:"|0c|scanerexcuse|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup screensavers1.info (malware)"; content:"|0d|screensavers1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shifustserver.com (malware)"; content:"|0d|shifustserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop.ccomp.cz (malware)"; content:"|04|shop|05|ccomp|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sirius-socks.cn (malware)"; content:"|0c|sirius-socks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softcoregroup.com (malvertisment)"; content:"|0d|softcoregroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softmetalgroup.com (malvertisment)"; content:"|0e|softmetalgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software2010.net (malvertisment)"; content:"|0c|software2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soldatus.com (zeus)"; content:"|08|soldatus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sphamifoaqpx.info (malvertisment)"; content:"|0c|sphamifoaqpx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statisticanalysis.info (malware)"; content:"|11|statisticanalysis|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stxtrade.com (malvertisment)"; content:"|08|stxtrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweethotteens.org (malware)"; content:"|0d|sweethotteens|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdrfhdzxyb.info (malvertisment)"; content:"|0a|tdrfhdzxyb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-dragon-cave.com (malvertisment)"; content:"|0f|the-dragon-cave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenutritiongroup.biz (malware)"; content:"|11|thenutritiongroup|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tidawgeihqch.info (malvertisment)"; content:"|0c|tidawgeihqch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tinytanks.net (malware)"; content:"|09|tinytanks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tissuespritz.com (malware)"; content:"|0c|tissuespritz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tklaxlxvedkt.info (malvertisment)"; content:"|0c|tklaxlxvedkt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tluaweyermg.info (malvertisment)"; content:"|0b|tluaweyermg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tmclean.info (malware)"; content:"|07|tmclean|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todayileft.com (malware)"; content:"|0a|todayileft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tommahercompany.info (malware)"; content:"|0f|tommahercompany|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trade-usa.net (malvertisment)"; content:"|09|trade-usa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradeexchangenetwork.com (malvertisment)"; content:"|14|tradeexchangenetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trademakers.ca (malvertisment)"; content:"|0b|trademakers|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tradeyainc.com (malvertisment)"; content:"|0a|tradeyainc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffichits247.com (malware)"; content:"|0e|traffichits247|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup troytabor.com (malware)"; content:"|09|troytabor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uefnwtnudve.com (malvertisment)"; content:"|0b|uefnwtnudve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uentfkblzpxx.info (malvertisment)"; content:"|0c|uentfkblzpxx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup undercoversquilting.com (malware)"; content:"|13|undercoversquilting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uoncvsqcuclx.info (malvertisment)"; content:"|0c|uoncvsqcuclx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uplevelgmno.vn.ua (malware)"; content:"|0b|uplevelgmno|02|vn|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uuyvsrbtpjhl.info (malvertisment)"; content:"|0c|uuyvsrbtpjhl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uwbhpcrydgta.info (malvertisment)"; content:"|0c|uwbhpcrydgta|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valleybarter.com (malvertisment)"; content:"|0c|valleybarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valleybartergroup.com (malvertisment)"; content:"|11|valleybartergroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuecard.biz (malvertisment)"; content:"|09|valuecard|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuecardalliance.com (malvertisment)"; content:"|11|valuecardalliance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuecardarizona.com (malvertisment)"; content:"|10|valuecardarizona|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuecardaz.com (malvertisment)"; content:"|0b|valuecardaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vertelitt.com (malware)"; content:"|09|vertelitt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vgmhlwrixzxz.info (malvertisment)"; content:"|0c|vgmhlwrixzxz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusscanlevela.com (malware)"; content:"|0f|virusscanlevela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viwterm.com (malware)"; content:"|07|viwterm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vnhdjolg.com (malware)"; content:"|08|vnhdjolg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vujpgvscrjbk.info (malvertisment)"; content:"|0c|vujpgvscrjbk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vwrvqmvrvjwi.info (malvertisment)"; content:"|0c|vwrvqmvrvjwi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wazprlhzhfvg.com (malvertisment)"; content:"|0c|wazprlhzhfvg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldcashlessbanc.com (malvertisment)"; content:"|11|worldcashlessbanc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwkzrjfuhmjg.info (malvertisment)"; content:"|0c|wwkzrjfuhmjg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdxq.cdu.edu.cn (malware)"; content:"|04|xdxq|03|cdu|03|edu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xewffvnixdyk.info (malvertisment)"; content:"|0c|xewffvnixdyk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xkduqnxfpnfg.info (malvertisment)"; content:"|0c|xkduqnxfpnfg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnboetuqunld.info (malvertisment)"; content:"|0c|xnboetuqunld|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xtunbiifnl.info (malvertisment)"; content:"|0a|xtunbiifnl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yburuvaeqcv.com (malvertisment)"; content:"|0b|yburuvaeqcv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yfguydudorip.info (malvertisment)"; content:"|0c|yfguydudorip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yggxvnwumcqv.info (malvertisment)"; content:"|0c|yggxvnwumcqv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yhaidebpfltr.info (malvertisment)"; content:"|0c|yhaidebpfltr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvaxtdzhbldc.com (malvertisment)"; content:"|0c|yvaxtdzhbldc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yynspckhyebi.info (malvertisment)"; content:"|0c|yynspckhyebi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zejdcqsoglao.info (malvertisment)"; content:"|0c|zejdcqsoglao|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zelhnalbivd.info (malvertisment)"; content:"|0b|zelhnalbivd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zrenie.cn (zeus)"; content:"|06|zrenie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsrsjnihnb.info (malvertisment)"; content:"|0a|zsrsjnihnb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zugponkeqtzz.info (malvertisment)"; content:"|0c|zugponkeqtzz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 17gr.co.tv (zeus/wsnpoem)"; content:"|04|17gr|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 188tan.cn (Trojan )"; content:"|06|188tan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 41ac.com (exploit)"; content:"|04|41ac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 44fj.com (exploit)"; content:"|04|44fj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5536megabyte.info (zeus/wsnpoem)"; content:"|0c|5536megabyte|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ackstone.com (Koobface)"; content:"|08|ackstone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup advance-pcdefender.in (rogue)"; content:"|12|advance-pcdefender|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aerostuff.ru (zeus/wsnpoem)"; content:"|09|aerostuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allinadayswork.org (Koobface)"; content:"|0e|allinadayswork|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allowolverin.in (exploit)"; content:"|0c|allowolverin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amzinas.com (exploit)"; content:"|07|amzinas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analiticterra.com (exploit)"; content:"|0d|analiticterra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankursociety.org (exploit)"; content:"|0c|ankursociety|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyare2help.com (rogue)"; content:"|0f|antispyare2help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyare4help.com (rogue)"; content:"|0f|antispyare4help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyare5help.com (rogue)"; content:"|0f|antispyare5help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyare7help.com (rogue)"; content:"|0f|antispyare7help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyare9help.com (rogue)"; content:"|0f|antispyare9help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus00help.com (rogue)"; content:"|0f|antivirus00help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus010scanner.com (rogue)"; content:"|13|antivirus010scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus01help.com (rogue)"; content:"|0f|antivirus01help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus030scanner.com (rogue)"; content:"|13|antivirus030scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus03help.com (rogue)"; content:"|0f|antivirus03help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus050scanner.com (rogue)"; content:"|13|antivirus050scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus06help.com (rogue)"; content:"|0f|antivirus06help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus070scanner.com (rogue)"; content:"|13|antivirus070scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus08help.com (rogue)"; content:"|0f|antivirus08help|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus090scanner.com (rogue)"; content:"|13|antivirus090scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusomega0.com (rogue)"; content:"|0f|antivirusomega0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusomega1.com (rogue)"; content:"|0f|antivirusomega1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusomega6.com (rogue)"; content:"|0f|antivirusomega6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusomega8.com (rogue)"; content:"|0f|antivirusomega8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusomega9.com (rogue)"; content:"|0f|antivirusomega9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusprotection01.com (rogue)"; content:"|15|antivirusprotection01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusprotection11.com (rogue)"; content:"|15|antivirusprotection11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusprotection22.com (rogue)"; content:"|15|antivirusprotection22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astonmartinpics.blogspot.com (rogue)"; content:"|0f|astonmartinpics|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autotradersuk.net (c&c)"; content:"|0d|autotradersuk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axaldjqt.cn (exploit)"; content:"|08|axaldjqt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bablodos.in (password_stealer)"; content:"|08|bablodos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bayinsurance.cn (malware)"; content:"|0c|bayinsurance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl1-virus-scanner.com (rogue)"; content:"|11|bl1-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl3-virus-scanner.com (rogue)"; content:"|11|bl3-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl5-virus-scanner.com (rogue)"; content:"|11|bl5-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl8-virus-scanner.com (rogue)"; content:"|11|bl8-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl9-virus-scanner.com (rogue)"; content:"|11|bl9-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccc213.ilive.ro (trojan)"; content:"|06|ccc213|05|ilive|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfssixsn.cn (exploit)"; content:"|08|cfssixsn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup characterscaner.cn (rogue)"; content:"|0f|characterscaner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click-poisk.com (malware)"; content:"|0b|click-poisk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contred033.org (malware)"; content:"|0a|contred033|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crazybunchsc.com (zeus/wsnpoem)"; content:"|0c|crazybunchsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curlicious.com (zeus/wsnpoem)"; content:"|0a|curlicious|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxim.asia (malware)"; content:"|04|cxim|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deviliz.com (zeus/wsnpoem)"; content:"|07|deviliz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discovertotalhealth.com (Koobface)"; content:"|13|discovertotalhealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domen-2010.com (zeus/wsnpoem)"; content:"|0a|domen-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dy61.com (exploit)"; content:"|04|dy61|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enzoforfree.ru (c&c)"; content:"|0b|enzoforfree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exitguide.ru (c&c)"; content:"|09|exitguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fel0ny.com (zeus/wsnpoem)"; content:"|06|fel0ny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffarms.net (Koobface)"; content:"|06|ffarms|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalspywarescanner0.com (rogue)"; content:"|14|finalspywarescanner0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalspywarescanner1.com (rogue)"; content:"|14|finalspywarescanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalspywarescanner4.com (rogue)"; content:"|14|finalspywarescanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalspywarescanner7.com (rogue)"; content:"|14|finalspywarescanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finalspywarescanner9.com (rogue)"; content:"|14|finalspywarescanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fontana.ru (zeus/wsnpoem)"; content:"|07|fontana|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frigologistics.nl (Koobface)"; content:"|0e|frigologistics|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup garavangzik.com (c&c)"; content:"|0b|garavangzik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getr1chordietry1n.info (zeus/wsnpoem)"; content:"|11|getr1chordietry1n|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gimcc.webd.pl (zeus/wsnpoem)"; content:"|05|gimcc|04|webd|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmaniac.com (Koobface)"; content:"|0a|goldmaniac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlanaliktics.com (zeus/wsnpoem)"; content:"|0f|googlanaliktics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlantivirusa.com (rogue)"; content:"|0f|googlantivirusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlantivirusc.com (rogue)"; content:"|0f|googlantivirusc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlantivirust.com (rogue)"; content:"|0f|googlantivirust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlantivirusu.com (rogue)"; content:"|0f|googlantivirusu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlantivirusw.com (rogue)"; content:"|0f|googlantivirusw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-statistics-uk-two.com (zeus/wsnpoem)"; content:"|18|google-statistics-uk-two|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotmerged.cn (malware)"; content:"|09|gotmerged|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup healthmann.pk (Koobface)"; content:"|0a|healthmann|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herault-automobiles.fr (Koobface)"; content:"|13|herault-automobiles|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hmcompany.info (exploit)"; content:"|09|hmcompany|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houreena.com (trojan)"; content:"|08|houreena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httptraffic.in (exploit)"; content:"|0b|httptraffic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hubys.com (zeus/wsnpoem)"; content:"|05|hubys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idnsservice.biz (exploit)"; content:"|0b|idnsservice|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineedcash.org (zeus/wsnpoem)"; content:"|09|ineedcash|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter-antivirus.com (rogue)"; content:"|0f|inter-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter1antivirus.com (rogue)"; content:"|0f|inter1antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter3antivirus.com (rogue)"; content:"|0f|inter3antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter6antivirus.com (rogue)"; content:"|0f|inter6antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter8antivirus.com (rogue)"; content:"|0f|inter8antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inter9antivirus.com (rogue)"; content:"|0f|inter9antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intera-antivirus.com (rogue)"; content:"|10|intera-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interc-antivirus.com (rogue)"; content:"|10|interc-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interd-antivirus.com (rogue)"; content:"|10|interd-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intere-antivirus.com (rogue)"; content:"|10|intere-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup investrade.sk (Koobface)"; content:"|0a|investrade|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irai.nerim.net (Trojan )"; content:"|04|irai|05|nerim|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcdcwxbjthr.com (torpig)"; content:"|0b|jcdcwxbjthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeasoftware.info (rogue)"; content:"|0b|jeasoftware|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jefshosjdve.com (zeus)"; content:"|0b|jefshosjdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jnsassociate.com (Trojan )"; content:"|0c|jnsassociate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jv-s.com (Koobface)"; content:"|04|jv-s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalowweb.de (zeus/wsnpoem)"; content:"|08|kalowweb|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kp49.com (exploit)"; content:"|04|kp49|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktsoft.eu (rogue)"; content:"|06|ktsoft|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laudunlardoiseavenir.fr (Koobface)"; content:"|14|laudunlardoiseavenir|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leonardandself.com (Koobface)"; content:"|0e|leonardandself|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lonvirtuel.com (zeus/wsnpoem)"; content:"|0a|lonvirtuel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lumibonu.su (zeus/wsnpoem)"; content:"|08|lumibonu|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv1-virus-scanner.com (rogue)"; content:"|11|lv1-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv2-virus-scanner.com (rogue)"; content:"|11|lv2-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv3-virus-scanner.com (rogue)"; content:"|11|lv3-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv5-virus-scanner.com (rogue)"; content:"|11|lv5-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lv8-virus-scanner.com (rogue)"; content:"|11|lv8-virus-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mad-i-bevaegelse.dk (Koobface)"; content:"|10|mad-i-bevaegelse|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mapssite.blogspot.com (rogue)"; content:"|08|mapssite|08|blogspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazra3ati-sudan.com (exploit)"; content:"|0f|mazra3ati-sudan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mes-lamination.com (malware)"; content:"|0e|mes-lamination|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-server1-update.com (malware)"; content:"|18|microsoft-server1-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-server2-update.com (malware)"; content:"|18|microsoft-server2-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-server3-update.com (malware)"; content:"|18|microsoft-server3-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-server4-update.com (malware)"; content:"|18|microsoft-server4-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-server5-update.com (malware)"; content:"|18|microsoft-server5-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mipolas.com (malware)"; content:"|07|mipolas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirikas.cn (c&c)"; content:"|07|mirikas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjisuvrmthr.com (torpig)"; content:"|0b|mjisuvrmthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moremediaplugins.net (rogue)"; content:"|10|moremediaplugins|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moretds.org (malware)"; content:"|07|moretds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muddbowl.com (exploit)"; content:"|08|muddbowl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycareermychoice.com (exploit)"; content:"|10|mycareermychoice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfirstguide.com (exploit)"; content:"|0c|myfirstguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylovebusiness.com (exploit)"; content:"|0e|mylovebusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myplaythegame.com (exploit)"; content:"|0d|myplaythegame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needno2search.com (zeus/wsnpoem)"; content:"|0d|needno2search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networksolutions5.net (zeus/wsnpoem)"; content:"|11|networksolutions5|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nickpie.com (zeus/wsnpoem)"; content:"|07|nickpie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordamerika-invest.com (exploit)"; content:"|12|nordamerika-invest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nospamnet.com (zeus/wsnpoem)"; content:"|09|nospamnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outuser.cn (rootkit)"; content:"|07|outuser|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pagadodireto.net (zeus/wsnpoem)"; content:"|0c|pagadodireto|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pageupndown.net (zeus/wsnpoem)"; content:"|0b|pageupndown|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pd41.com (exploit)"; content:"|04|pd41|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup person.doae.go.th (Koobface)"; content:"|06|person|04|doae|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfgeeeepdve.com (exploit)"; content:"|0b|pfgeeeepdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photovideo.uz (zeus/wsnpoem)"; content:"|0a|photovideo|02|uz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper0antispyware.com (rogue)"; content:"|12|proper0antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper1antivirus.com (rogue)"; content:"|10|proper1antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper3antivirus.com (rogue)"; content:"|10|proper3antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper5antivirus.com (rogue)"; content:"|10|proper5antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper6antispyware.com (rogue)"; content:"|12|proper6antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper7antispyware.com (rogue)"; content:"|12|proper7antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper7antivirus.com (rogue)"; content:"|10|proper7antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper8antispyware.com (rogue)"; content:"|12|proper8antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper8antivirus.com (rogue)"; content:"|10|proper8antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proper9antispyware.com (rogue)"; content:"|12|proper9antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospywarescanner1.com (rogue)"; content:"|12|prospywarescanner1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospywarescanner5.com (rogue)"; content:"|12|prospywarescanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospywarescanner7.com (rogue)"; content:"|12|prospywarescanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospywarescanner8.com (rogue)"; content:"|12|prospywarescanner8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospywarescanner9.com (rogue)"; content:"|12|prospywarescanner9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quick-antispyware.com (rogue)"; content:"|11|quick-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickaantispyware.com (rogue)"; content:"|11|quickaantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickbantispyware.com (rogue)"; content:"|11|quickbantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickcantispyware.com (rogue)"; content:"|11|quickcantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickdantispyware.com (rogue)"; content:"|11|quickdantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realixlove.net (exploit)"; content:"|0a|realixlove|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realtorrentltd.ru (zeus/wsnpoem)"; content:"|0e|realtorrentltd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup repuzer.net.ua (zeus/wsnpoem)"; content:"|07|repuzer|03|net|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalfuls.com (zeus/wsnpoem)"; content:"|09|royalfuls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saloongins.net (malware)"; content:"|0a|saloongins|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scana-antispyware.com (rogue)"; content:"|11|scana-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanc-antispyware.com (rogue)"; content:"|11|scanc-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scane-antispyware.com (rogue)"; content:"|11|scane-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scani-antispyware.com (rogue)"; content:"|11|scani-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scant-antispyware.com (rogue)"; content:"|11|scant-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup se56.com (Trojan )"; content:"|04|se56|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretshoper.info (zeus/wsnpoem)"; content:"|0c|secretshoper|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security010scanner.com (rogue)"; content:"|12|security010scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security020scanner.com (rogue)"; content:"|12|security020scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security030scanner.com (rogue)"; content:"|12|security030scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security040scanner.com (rogue)"; content:"|12|security040scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security050scanner.com (rogue)"; content:"|12|security050scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serverdrom.com (exploit)"; content:"|0a|serverdrom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siteadvertise4you.net (zeus/wsnpoem)"; content:"|11|siteadvertise4you|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skullsmod.com (exploit)"; content:"|09|skullsmod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slovestond.com (zeus/wsnpoem)"; content:"|0a|slovestond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup steggba.com (zeus/wsnpoem)"; content:"|07|steggba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tumasolt.com (zeus/wsnpoem)"; content:"|08|tumasolt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ty42.com (trojan)"; content:"|04|ty42|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubcvesuuthr.com (torpig)"; content:"|0b|ubcvesuuthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unb0rn.biz (exploit)"; content:"|06|unb0rn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v-murmanske.ru (zeus/wsnpoem)"; content:"|0b|v-murmanske|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wildbunchsc.com (zeus/wsnpoem)"; content:"|0b|wildbunchsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windesktopsecurity.com (rogue)"; content:"|12|windesktopsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxsss.net (zeus/wsnpoem)"; content:"|06|xxxsss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourweekends.net (rogue)"; content:"|0c|yourweekends|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yrots.ru (trojan)"; content:"|05|yrots|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yumi.org.ua (trojan)"; content:"|04|yumi|03|org|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z131588.infobox.ru (zeus/wsnpoem)"; content:"|07|z131588|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 978cf.com (malware)"; content:"|05|978cf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aafoocgv.cn (exploit)"; content:"|08|aafoocgv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abulasspokas.net (fraud )"; content:"|0c|abulasspokas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrasso.com (fastflux)"; content:"|07|acrasso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acunterstates.net (fraud )"; content:"|0d|acunterstates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adomuistiktes.net (fraud )"; content:"|0d|adomuistiktes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adrembovesttes.net (fraud )"; content:"|0e|adrembovesttes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adrotator.mediaplex.feed-mnptr.com (malvertisement)"; content:"|09|adrotator|09|mediaplex|0a|feed-mnptr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwarealert.com (rogue)"; content:"|0b|adwarealert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aervrfhu.ru (zeus/wsnpoem)"; content:"|08|aervrfhu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aformanionas.net (fraud )"; content:"|0c|aformanionas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afropelosentes.net (fraud )"; content:"|0e|afropelosentes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahouperstofas.net (fraud )"; content:"|0d|ahouperstofas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnatroniksssss.com (zeus/wsnpoem)"; content:"|10|allnatroniksssss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almi-tour.ru (malware)"; content:"|09|almi-tour|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alsaer.info (malware)"; content:"|06|alsaer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amenthe.nl (malware)"; content:"|07|amenthe|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amorinerowas.net (fraud )"; content:"|0c|amorinerowas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analytics2.org (zeus)"; content:"|0a|analytics2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anergosedattes.net (fraud )"; content:"|0e|anergosedattes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware.com (rogue)"; content:"|0b|antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware2008.com (rogue)"; content:"|0f|antispyware2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-protection.com (malware)"; content:"|12|antivir-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusprommx.com (malware)"; content:"|0f|antivirusprommx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aplewasmedtes.net (fraud )"; content:"|0d|aplewasmedtes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apologal.com (malware)"; content:"|08|apologal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apoose.in (neosploit)"; content:"|06|apoose|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aredroutertes.net (fraud )"; content:"|0d|aredroutertes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asammary.com (malware)"; content:"|08|asammary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asorutinodtes.com (fraud )"; content:"|0d|asorutinodtes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asspuc.com (malware)"; content:"|06|asspuc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atackedleavesused.cn (fraud )"; content:"|11|atackedleavesused|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atacktrickschange.cn (fraud )"; content:"|11|atacktrickschange|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atemptingconfusedhang.cn (fraud )"; content:"|15|atemptingconfusedhang|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atitudeasaultrelease.cn (fraud )"; content:"|14|atitudeasaultrelease|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augustfapegame.cn (fraud )"; content:"|0e|augustfapegame|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aviolafouttes.net (fraud )"; content:"|0d|aviolafouttes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avppi.com (oficla )"; content:"|05|avppi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aweprolikartes.net (fraud )"; content:"|0e|aweprolikartes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup backstoryreceivedknowing.cn (fraud )"; content:"|18|backstoryreceivedknowing|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankingsecondsalute.cn (fraud )"; content:"|13|bankingsecondsalute|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barbaraslapsiphone.cn (fraud )"; content:"|12|barbaraslapsiphone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barbaraspentsoda.cn (fraud )"; content:"|10|barbaraspentsoda|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup becausesymptomsdesk.cn (fraud )"; content:"|13|becausesymptomsdesk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beckhamsomeinternational.cn (fraud )"; content:"|18|beckhamsomeinternational|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belgianherelocal.cn (fraud )"; content:"|10|belgianherelocal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup believedwekdayfoursquare.cn (fraud )"; content:"|18|believedwekdayfoursquare|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bentley.co.kr (trojan )"; content:"|07|bentley|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bergushistes.net (fraud )"; content:"|0c|bergushistes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestreportws12.in (zeus/wsnpoem)"; content:"|0e|bestreportws12|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beststatscounter.us (zeus/wsnpoem)"; content:"|10|beststatscounter|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfhqrmtm.cn (malware)"; content:"|08|bfhqrmtm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bokstechsupersj.cn (fraud )"; content:"|0f|bokstechsupersj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borugrestotes.net (fraud )"; content:"|0d|borugrestotes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxingeatingshare.cn (fraud )"; content:"|11|boxingeatingshare|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxingstudyprotruding.cn (fraud )"; content:"|15|boxingstudyprotruding|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broughtswinemidle.cn (fraud )"; content:"|11|broughtswinemidle|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browseblanksfod.cn (fraud )"; content:"|0f|browseblanksfod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsewakefatherhod.cn (fraud )"; content:"|13|browsewakefatherhod|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buisenesscorp.com (zeus/wsnpoem)"; content:"|0d|buisenesscorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buyyoursex.com (malware)"; content:"|0a|buyyoursex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-team.net (malware)"; content:"|0c|capital-team|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashsblog.cn (fraud )"; content:"|09|cashsblog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashsdeal.cn (fraud )"; content:"|09|cashsdeal|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashspeed.cn (fraud )"; content:"|09|cashspeed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashsrc.cn (fraud )"; content:"|07|cashsrc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashsurf.cn (fraud )"; content:"|08|cashsurf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashwork.cn (fraud )"; content:"|08|cashwork|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinonext.ru (malware)"; content:"|0a|casinonext|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralspl.ru (zeus/wsnpoem)"; content:"|0a|centralspl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceteploudas.net (fraud )"; content:"|0b|ceteploudas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cha.91mt.com (malware)"; content:"|03|cha|04|91mt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinapower7.com (zeus/wsnpoem)"; content:"|0b|chinapower7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coisalindinhalegal.com (malware)"; content:"|12|coisalindinhalegal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosadeborracho.com.ar (malware)"; content:"|0e|cosadeborracho|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countrtds.ru (malware)"; content:"|09|countrtds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crushed.in (exploit)"; content:"|07|crushed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuddly.in (exploit)"; content:"|06|cuddly|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cut-down.in (malware)"; content:"|08|cut-down|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dainty.in (malware)"; content:"|06|dainty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datingtipsforman.net (malware)"; content:"|10|datingtipsforman|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dauntless.in (exploit)"; content:"|09|dauntless|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debated.in (exploit)"; content:"|07|debated|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defective.in (exploit)"; content:"|09|defective|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgnews.org (zeus/wsnpoem)"; content:"|06|dgnews|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnf10086.com (trojan)"; content:"|08|dnf10086|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dobmvnh.com (zeus/wsnpoem)"; content:"|07|dobmvnh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dovetox.com (fastflux)"; content:"|07|dovetox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.evidenceeraser.com (malware)"; content:"|08|download|0e|evidenceeraser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drop.az (malware)"; content:"|04|drop|02|az"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsdwwewe.com (malware)"; content:"|08|dsdwwewe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dzinternet.co.cc (zeus/wsnpoem)"; content:"|0a|dzinternet|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eivom3d.ru (malware)"; content:"|07|eivom3d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eiweimiupeiviadi.in (malware)"; content:"|10|eiweimiupeiviadi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eliminateall.com (malware)"; content:"|0c|eliminateall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup en.kyod.biz (zeus/wsnpoem)"; content:"|02|en|04|kyod|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excode.info (zeus/wsnpoem)"; content:"|06|excode|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extemi.com (fastflux)"; content:"|06|extemi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extrasales.in (malware)"; content:"|0a|extrasales|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facbooks.yourfreehosting.net (malware)"; content:"|08|facbooks|0f|yourfreehosting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-c.com (malware)"; content:"|0a|facebook-c|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fekete.org (malware)"; content:"|06|fekete|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffret.ru (malware)"; content:"|05|ffret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filemediagroup.com (malware)"; content:"|0e|filemediagroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findinamica.info (malware)"; content:"|0b|findinamica|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup florikast.com (malware)"; content:"|09|florikast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flutegraph.cn (fraud )"; content:"|0a|flutegraph|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.rawafedschool.com (malware)"; content:"|05|forum|0d|rawafedschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forumbeat.info (zeus/wsnpoem)"; content:"|09|forumbeat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup friporn-besplatno.info (malware)"; content:"|11|friporn-besplatno|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fstt.dsdwwewe.com (malware)"; content:"|04|fstt|08|dsdwwewe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamederp.ru (malware)"; content:"|08|gamederp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghtsuumuno.com (neosploit)"; content:"|0a|ghtsuumuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globetechnologies.com (zeus/wsnpoem)"; content:"|11|globetechnologies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodmultimediaonline.net (malware)"; content:"|14|goodmultimediaonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hebragr.com (fastflux)"; content:"|07|hebragr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjwbxhqr.cn (exploit)"; content:"|08|hjwbxhqr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honeypussy.info (malware)"; content:"|0a|honeypussy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horovod.in (malware)"; content:"|07|horovod|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howlit.info (malware)"; content:"|06|howlit|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iam.superfluxed.net (zeus/wsnpoem)"; content:"|03|iam|0b|superfluxed|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifgaqfyithr.com (torpig)"; content:"|0b|ifgaqfyithr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imguser.com (malware)"; content:"|07|imguser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imhiddene.ishidden.net (zeus/wsnpoem)"; content:"|09|imhiddene|08|ishidden|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intil.info (malware)"; content:"|05|intil|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioretiop.com (zeus/wsnpoem)"; content:"|08|ioretiop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issimode.net (exploit)"; content:"|08|issimode|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetespomertes.net (fraud )"; content:"|0d|jetespomertes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnm.tmweb.ru (zeus/wsnpoem)"; content:"|05|johnm|05|tmweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joukwerostes.net (fraud )"; content:"|0c|joukwerostes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasp.x10hosting.com (zeus/wsnpoem)"; content:"|04|kasp|0a|x10hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kenoie.com (trojan )"; content:"|06|kenoie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keynots.com (malware)"; content:"|07|keynots|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiropadonttes.com (fraud )"; content:"|0d|kiropadonttes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopolinos.com (exploit)"; content:"|09|kopolinos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ks45tn2.cn (malware)"; content:"|07|ks45tn2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kslotz.co.cc (malware)"; content:"|06|kslotz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l63.ln.cn (malware)"; content:"|03|l63|02|ln|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lctk.biz (malware)"; content:"|04|lctk|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leacherz.net (malware)"; content:"|08|leacherz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lecizens.com (fastflux)"; content:"|08|lecizens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopokerasandco.hk (malware)"; content:"|0e|lopokerasandco|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lrfjkzlx.cn (exploit)"; content:"|08|lrfjkzlx|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maurers.tv (malware)"; content:"|07|maurers|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaindustrydata.com (malware)"; content:"|11|mediaindustrydata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medianettools.com (malware)"; content:"|0d|medianettools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megalithrecords.com (zeus/wsnpoem)"; content:"|0f|megalithrecords|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minimpucash.net (fraud )"; content:"|0b|minimpucash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobidomaining.info (malware)"; content:"|0d|mobidomaining|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilemultimediadata.com (malware)"; content:"|14|mobilemultimediadata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mogus.in (malware)"; content:"|05|mogus|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movreportes.net (fraud )"; content:"|0b|movreportes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mp3-zdarma.tym.sk (malware)"; content:"|0a|mp3-zdarma|03|tym|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mszone.sytes.net (malware)"; content:"|06|mszone|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-next-love.ru (malware)"; content:"|0c|my-next-love|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my.msn-fbgallery.net (malware)"; content:"|02|my|0d|msn-fbgallery|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup narkyl.com (zeus)"; content:"|06|narkyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon3.com (exploit)"; content:"|0c|newptlisbon3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon4.com (malware)"; content:"|0c|newptlisbon4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon5.com (exploit)"; content:"|0c|newptlisbon5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon6.com (exploit)"; content:"|0c|newptlisbon6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon7.com (exploit)"; content:"|0c|newptlisbon7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon8.com (exploit)"; content:"|0c|newptlisbon8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newptlisbon9.com (exploit)"; content:"|0c|newptlisbon9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt01.co.in (exploit)"; content:"|04|nt01|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt11.co.in (exploit)"; content:"|04|nt11|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obiassi.com (fastflux)"; content:"|07|obiassi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceandigitalfilm.com (malware)"; content:"|10|oceandigitalfilm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup old.hi5photos.us (malware)"; content:"|03|old|09|hi5photos|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ordegofindates.com (fraud )"; content:"|0e|ordegofindates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outshed.com (malware)"; content:"|07|outshed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p1anka.cn (malware)"; content:"|06|p1anka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pachaclub.in (malware)"; content:"|09|pachaclub|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paedagogisches-journal.de (malware)"; content:"|16|paedagogisches-journal|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patologo.ru (trojan)"; content:"|08|patologo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perdiusmodtes.net (fraud )"; content:"|0d|perdiusmodtes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photocourtesy.com (malware)"; content:"|0d|photocourtesy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipiskin.hk (zeus/wsnpoem)"; content:"|08|pipiskin|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornokinoxxx.ru (malware)"; content:"|0c|pornokinoxxx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prodloader14.info (rogue)"; content:"|0c|prodloader14|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proprator14.info (rogue)"; content:"|0b|proprator14|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puppetmasterz.org (zeus/wsnpoem)"; content:"|0d|puppetmasterz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puthere.info (brebolab )"; content:"|07|puthere|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qefshvsqdve.com (malware)"; content:"|0b|qefshvsqdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red-phoenix.info (zeus/wsnpoem)"; content:"|0b|red-phoenix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalityfull.net (zeus/wsnpoem)"; content:"|0c|royalityfull|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sakura2.cn (zeus/wsnpoem)"; content:"|07|sakura2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satofepolas.net (fraud )"; content:"|0b|satofepolas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satregonovates.net (fraud )"; content:"|0e|satregonovates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scnadator14.info (rogue)"; content:"|0b|scnadator14|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-network-plus.com (malware)"; content:"|13|search-network-plus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchportrait.org (malware)"; content:"|0e|searchportrait|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sectionsecuredsite.info (fastflux)"; content:"|12|sectionsecuredsite|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureway.bz (zeus/wsnpoem)"; content:"|09|secureway|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selectsolution.net (malware)"; content:"|0e|selectsolution|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servisesocks5.com (malware)"; content:"|0d|servisesocks5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex.kissx.ru (trojan)"; content:"|03|sex|05|kissx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexshopcafe.com (malware)"; content:"|0b|sexshopcafe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sikis19.net (malware)"; content:"|07|sikis19|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sofgeromiustes.net (fraud )"; content:"|0e|sofgeromiustes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sondiuperotes.net (fraud )"; content:"|0d|sondiuperotes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorpresas.uni.cc (malware)"; content:"|09|sorpresas|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundboard.com (malware)"; content:"|0a|soundboard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spirims.com (zeus/wsnpoem)"; content:"|07|spirims|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spokionertes.net (fraud )"; content:"|0c|spokionertes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sponsoryregysters.com (malware)"; content:"|11|sponsoryregysters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spuperrrtransfer.com (malware)"; content:"|10|spuperrrtransfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup studiocom.com.br (malware)"; content:"|09|studiocom|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornmovies.info (trojandropper)"; content:"|10|super-pornmovies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornomovie.info (trojandropper)"; content:"|10|super-pornomovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornomovies.info (trojandropper)"; content:"|11|super-pornomovies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornovideo.info (trojandropper)"; content:"|10|super-pornovideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornovideos.info (trojandropper)"; content:"|11|super-pornovideos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornvideo.info (trojandropper)"; content:"|0f|super-pornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-pornvideos.info (trojandropper)"; content:"|10|super-pornvideos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporn-movie.info (trojandropper)"; content:"|0f|superporn-movie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporn-movies.info (trojandropper)"; content:"|10|superporn-movies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporn-video.info (trojandropper)"; content:"|0f|superporn-video|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporn-videos.info (trojandropper)"; content:"|10|superporn-videos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporno-movie.info (trojandropper)"; content:"|10|superporno-movie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporno-movies.info (trojandropper)"; content:"|11|superporno-movies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporno-video.info (trojandropper)"; content:"|10|superporno-video|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superporno-videos.info (trojandropper)"; content:"|11|superporno-videos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swat4.gram.pl (malware)"; content:"|05|swat4|04|gram|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsclick4.com (neosploit)"; content:"|09|tdsclick4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thanksimage.com (malware)"; content:"|0b|thanksimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tnirif.info (neosploit)"; content:"|06|tnirif|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukbankstop10compare.com (iframe)"; content:"|13|ukbankstop10compare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateinfo22.com (malware)"; content:"|0c|updateinfo22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uper-pornmovie.info (trojandropper)"; content:"|0e|uper-pornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usuarios.multimania.es (malware)"; content:"|08|usuarios|0a|multimania|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup validatestreams.com (malware)"; content:"|0f|validatestreams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vasermatniktes.net (fraud )"; content:"|0e|vasermatniktes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkratingx.ru (malware)"; content:"|09|vkratingx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voquerofomtes.net (fraud )"; content:"|0d|voquerofomtes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vur-for-itonpcnow.in (rogue)"; content:"|11|vur-for-itonpcnow|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vurfor-itonpc-now.in (rogue)"; content:"|11|vurfor-itonpc-now|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuurowes.com (malware)"; content:"|08|vuurowes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvvilon.com (malware)"; content:"|07|vvvilon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup walers.tk (fastflux)"; content:"|06|walers|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websecuresection.info (fastflux)"; content:"|10|websecuresection|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wentiscopertes.net (fraud )"; content:"|0e|wentiscopertes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woperdosas.net (fraud )"; content:"|0a|woperdosas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wowtribes.com (malware)"; content:"|09|wowtribes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x554b9c1b.co.cc (trojan)"; content:"|09|x554b9c1b|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xtubegexxx.in (malware)"; content:"|0a|xtubegexxx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxvidzforfree.net (malware)"; content:"|0e|xxxvidzforfree|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycgezkpu.cn (exploit)"; content:"|08|ycgezkpu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yougoodvideo.net (malware)"; content:"|0c|yougoodvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youporn8.net (malware)"; content:"|08|youporn8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z130827.infobox.ru (malware)"; content:"|07|z130827|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zapolunenates.net (fraud )"; content:"|0d|zapolunenates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zooom.heliohost.org (zeus/wsnpoem)"; content:"|05|zooom|09|heliohost|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 175850334.com (malware)"; content:"|09|175850334|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdcwpbathr.com (torping)"; content:"|0b|acdcwpbathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acedru.com (malware)"; content:"|06|acedru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-gb.net (malware)"; content:"|06|ads-gb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adserver-de.net (malware)"; content:"|0b|adserver-de|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankogeu.com (fastflux)"; content:"|07|ankogeu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annnddd.in (neosploit)"; content:"|07|annnddd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avbillsolution.com (fraud)"; content:"|0e|avbillsolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplus-sscanerr.org (rogue)"; content:"|0f|avplus-sscanerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awinav.com (rogue)"; content:"|06|awinav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awinguard.com (rogue)"; content:"|09|awinguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balhimana.com (exploits)"; content:"|09|balhimana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beirut1974.com (malware)"; content:"|0a|beirut1974|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bendigomarko.biz (malware)"; content:"|0c|bendigomarko|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestarray.com (malware)"; content:"|09|bestarray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfullmedia.com (fastflux)"; content:"|0d|bestfullmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bomodf.ru (malware)"; content:"|06|bomodf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonneav.com (rogue)"; content:"|07|bonneav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bymbasas.com (zeus)"; content:"|08|bymbasas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinacxyy.com (malware)"; content:"|09|chinacxyy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinemalogo.com (fastflux)"; content:"|0a|cinemalogo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click-es.net (malware)"; content:"|08|click-es|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup climerstentes.net (malware)"; content:"|0d|climerstentes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contobeonline.in (trojan_fakevimes )"; content:"|0d|contobeonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crossmediatools.com (fastflux)"; content:"|0f|crossmediatools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakof-cure-for-mypc.in (trojan_fakevimes )"; content:"|13|dakof-cure-for-mypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakof-cure-formypc.in (trojan_fakevimes )"; content:"|12|dakof-cure-formypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakof-cureformypc.in (trojan_fakevimes )"; content:"|11|dakof-cureformypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakofcure-for-mypc.in (trojan_fakevimes )"; content:"|12|dakofcure-for-mypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakofcure-formypc.in (trojan_fakevimes )"; content:"|11|dakofcure-formypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakofcurefor-mypc.in (trojan_fakevimes )"; content:"|11|dakofcurefor-mypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakofcureformy-pc.in (trojan_fakevimes )"; content:"|11|dakofcureformy-pc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakofcureformypc.in (trojan_fakevimes )"; content:"|10|dakofcureformypc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datamultimediaonline.com (fastflux)"; content:"|14|datamultimediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datasoftmedia.com (fastflux)"; content:"|0d|datasoftmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datatechdigital.com (fastflux)"; content:"|0f|datatechdigital|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degi50ndr78.in (trojan_fakevimes )"; content:"|0b|degi50ndr78|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degi51ndr78.in (trojan_fakevimes )"; content:"|0b|degi51ndr78|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlediup.com (fastflux)"; content:"|07|dlediup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnuos.ru (malware)"; content:"|05|dnuos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.softmanoc.com (malware)"; content:"|08|download|09|softmanoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dr-av.com (rogue)"; content:"|05|dr-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drgav.com (rogue)"; content:"|05|drgav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erlegit.com (fastflux)"; content:"|07|erlegit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup experimentaltraffic.com (malware)"; content:"|13|experimentaltraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-andsafe-curepc.in (trojan_fakevimes )"; content:"|13|fast-andsafe-curepc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fecsolutions.com.br (malware)"; content:"|0c|fecsolutions|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgdchevuno.net (exploits)"; content:"|0a|fgdchevuno|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgnmgojuno.com (exploits)"; content:"|0a|fgnmgojuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fictioncinema.com (fastflux)"; content:"|0d|fictioncinema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fif-searchvirs7.in (trojan_fakevimes )"; content:"|0f|fif-searchvirs7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesmediaonline.com (fastflux)"; content:"|10|filesmediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitfullmedia.com (fastflux)"; content:"|0c|fitfullmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fogat48in5.in (trojan_fakevimes )"; content:"|0a|fogat48in5|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fullpackcodecs.com (malware)"; content:"|0e|fullpackcodecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fun4sex.ru (malware)"; content:"|07|fun4sex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gametester.ru (malware)"; content:"|0a|gametester|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamevery1.ru (exploit)"; content:"|09|gamevery1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamez-lux.com (malspam)"; content:"|09|gamez-lux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcdmcklgthr.com (torping)"; content:"|0b|gcdmcklgthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get.serdb01.com (malware)"; content:"|03|get|07|serdb01|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getbonuszcheck.biz (malware)"; content:"|0e|getbonuszcheck|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghostbusters.cc (illegal)"; content:"|0c|ghostbusters|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigfourm.com (malware)"; content:"|08|gigfourm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatarray.com (exploit)"; content:"|0a|greatarray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatmultimediaservices.com (fastflux)"; content:"|17|greatmultimediaservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gxwuyyuno.com (exploits)"; content:"|09|gxwuyyuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hmcompany.org (malware)"; content:"|09|hmcompany|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huhfu-fudi.in (trojan_fakevimes )"; content:"|0a|huhfu-fudi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huhfuf-udi.in (trojan_fakevimes )"; content:"|0a|huhfuf-udi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huil.in (malware)"; content:"|04|huil|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i-want-u.ru (neosploit)"; content:"|08|i-want-u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iiiiiiiiiiiiii.net (zeus/wsnpoem)"; content:"|0e|iiiiiiiiiiiiii|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imageexists.com (malware)"; content:"|0b|imageexists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inasss.info (zeus)"; content:"|06|inasss|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infolookmultimedia.com (fastflux)"; content:"|12|infolookmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insiso.co.uk (malware)"; content:"|06|insiso|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcdqdaqjdve.com (exploits)"; content:"|0b|jcdqdaqjdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jit-in-my-zonetoclear.in (trojan_fakevimes )"; content:"|15|jit-in-my-zonetoclear|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jit-inmy-zonetoclear.in (trojan_fakevimes )"; content:"|14|jit-inmy-zonetoclear|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justemedia.com (fastflux)"; content:"|0a|justemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kontroli.ru (malware)"; content:"|08|kontroli|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuwaityah.100free.com (malware)"; content:"|09|kuwaityah|07|100free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lianwdnldve.com (exploits)"; content:"|0b|lianwdnldve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limpviesys7.in (trojan_fakevimes )"; content:"|0b|limpviesys7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mature-spermorgies.com (fastflux)"; content:"|12|mature-spermorgies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviemediatools.com (fastflux)"; content:"|0f|moviemediatools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediafileskeeping.com (fastflux)"; content:"|16|multimediafileskeeping|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediautilites.com (fastflux)"; content:"|12|multimediautilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameservicehosting.in (malware)"; content:"|12|nameservicehosting|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naotemprec0.com (malware)"; content:"|0b|naotemprec0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new2476.com (exploit)"; content:"|07|new2476|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onts68nsd7.in (trojan_fakevimes )"; content:"|0a|onts68nsd7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup papindos.info (zeus)"; content:"|08|papindos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passengertraffic.com (malware)"; content:"|10|passengertraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbcvezupthr.com (torping)"; content:"|0b|pbcvezupthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcs-av.com (rogue)"; content:"|06|pcs-av|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pefpuklkoyl.com (malware)"; content:"|0b|pefpuklkoyl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup persh.org (malware)"; content:"|05|persh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phjlsblpdve.com (exploits)"; content:"|0b|phjlsblpdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-pornomovies.info (malware)"; content:"|10|play-pornomovies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poker500.ro (malware)"; content:"|08|poker500|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promolistings.net (trojan_zbot )"; content:"|0d|promolistings|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qabaqbyqthr.com (malware)"; content:"|0b|qabaqbyqthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qefhgujquno.com (exploits)"; content:"|0b|qefhgujquno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghpbapqdve.com (neosploit)"; content:"|0b|qghpbapqdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queodaesahpiabie.in (malware)"; content:"|10|queodaesahpiabie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickmath12.info (malware)"; content:"|0b|quickmath12|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rgfd12ghi89.in (trojan_fakevimes )"; content:"|0b|rgfd12ghi89|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubyfortune.mgsmup.com (malspam)"; content:"|0b|rubyfortune|06|mgsmup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanctuaryjax.org (threat)"; content:"|0c|sanctuaryjax|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4you.biz (illegal)"; content:"|08|scan4you|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanerwhatever.cn (malware)"; content:"|0e|scanerwhatever|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scaprilia.com (threat)"; content:"|09|scaprilia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secline777.net (malware)"; content:"|0a|secline777|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secline999.net (trojan_zbot )"; content:"|0a|secline999|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securecheks.x10hosting.com (malware)"; content:"|0b|securecheks|0a|x10hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snubbet.com (malware)"; content:"|07|snubbet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softpayb.com (fraud)"; content:"|08|softpayb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-searchigsi.in (trojan_fakevimes )"; content:"|0e|sys-searchigsi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysoptechs.com (malware)"; content:"|0a|sysoptechs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysvircheck5.in (trojan_fakevimes )"; content:"|0c|sysvircheck5|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tbcpbxptdve.com (neosploit)"; content:"|0b|tbcpbxptdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tbcyxeatuno.com (exploits)"; content:"|0b|tbcyxeatuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup termsys100.in (trojan_fakevimes )"; content:"|0a|termsys100|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terrificmultimedia.com (fastflux)"; content:"|12|terrificmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup test2.salefale.com (malware)"; content:"|05|test2|08|salefale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefilesmultimedia.com (fastflux)"; content:"|12|thefilesmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepalacegroupgaming.com (malspam)"; content:"|14|thepalacegroupgaming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thjgjcgtdve.com (exploits)"; content:"|0b|thjgjcgtdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topix21century.com (malware)"; content:"|0e|topix21century|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttcandle.com (malware)"; content:"|08|ttcandle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutamc.com (malware)"; content:"|06|tutamc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usworldcast.com (trojan_zbot )"; content:"|0b|usworldcast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vixeyjix.com (fastflux)"; content:"|08|vixeyjix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wghgiwfwthr.com (malware)"; content:"|0b|wghgiwfwthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wilpowerenergy.com (threat)"; content:"|0e|wilpowerenergy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wolseleyworkwear.com (malware)"; content:"|10|wolseleyworkwear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrapp.info (rogue)"; content:"|05|wrapp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzone-at-safe-toclean.in (trojan_fakevimes )"; content:"|16|xdzone-at-safe-toclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzone-at-safetoclean.in (trojan_fakevimes )"; content:"|15|xdzone-at-safetoclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzone-atsafe-toclean.in (trojan_fakevimes )"; content:"|15|xdzone-atsafe-toclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzone-atsafeto-clean.in (trojan_fakevimes )"; content:"|15|xdzone-atsafeto-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneat-safe-to-clean.in (trojan_fakevimes )"; content:"|16|xdzoneat-safe-to-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneat-safe-toclean.in (trojan_fakevimes )"; content:"|15|xdzoneat-safe-toclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneat-safeto-clean.in (trojan_fakevimes )"; content:"|15|xdzoneat-safeto-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneatsafe-toclean.in (trojan_fakevimes )"; content:"|14|xdzoneatsafe-toclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneatsafeto-clean.in (trojan_fakevimes )"; content:"|14|xdzoneatsafeto-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdzoneatsafetoclean.in (trojan_fakevimes )"; content:"|13|xdzoneatsafetoclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zxfr.salefale.com (malware)"; content:"|04|zxfr|08|salefale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 842389423478923.com (malware)"; content:"|0f|842389423478923|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaa419.com (malware)"; content:"|06|aaa419|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admediatools.com (malware)"; content:"|0c|admediatools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghgiqfathr.com (malware)"; content:"|0b|aghgiqfathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-onecare2010.com (rogue)"; content:"|15|antivirus-onecare2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivp.com (rogue)"; content:"|06|antivp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivpc.com (rogue)"; content:"|07|antivpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arriviertes.com (malware)"; content:"|0b|arriviertes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asiandvdtime.com (koobface)"; content:"|0c|asiandvdtime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assofranchising.it (malware)"; content:"|0f|assofranchising|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup austinme.com (zeus/wsnpoem)"; content:"|08|austinme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automaticallyfind.org (malware)"; content:"|11|automaticallyfind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-guru.net (rogue)"; content:"|07|av-guru|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aylmershotgun.com (exploit)"; content:"|0d|aylmershotgun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baksomania2010.ru (malware)"; content:"|0e|baksomania2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beinahet.com (malware)"; content:"|08|beinahet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestreportwas142.in (zeus/wsnpoem)"; content:"|10|bestreportwas142|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacktraf.su (malware)"; content:"|09|blacktraf|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombozzz.com (zeus/wsnpoem)"; content:"|08|bombozzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boomarrow.com (malware)"; content:"|09|boomarrow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bravetools.net (exploit)"; content:"|0a|bravetools|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brunongino.com (exploit)"; content:"|0a|brunongino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calvinkleinstuffz.com (zeus/wsnpoem)"; content:"|11|calvinkleinstuffz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cam.rubberduck.ws (zeus/wsnpoem)"; content:"|03|cam|0a|rubberduck|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cargounioninc.com (zeus/wsnpoem)"; content:"|0d|cargounioninc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cargoworldexchange.com (zeus/wsnpoem)"; content:"|12|cargoworldexchange|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup castellanasportsclub.com (exploit)"; content:"|14|castellanasportsclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catsshow2online.info (malware)"; content:"|0f|catsshow2online|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cedelevator.com (koobface)"; content:"|0b|cedelevator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceffincf.com (exploit)"; content:"|08|ceffincf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebrityboom.com (fake_codec)"; content:"|0d|celebrityboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centryfag.com (zeus/wsnpoem)"; content:"|09|centryfag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfdnf.com (trojan)"; content:"|05|cfdnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheaphgall.com (trojan)"; content:"|0a|cheaphgall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkliet.com (rogue)"; content:"|09|checkliet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chephall.com (trojan)"; content:"|08|chephall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clipplaces.com (trojan)"; content:"|0a|clipplaces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup concursos-peugeot.com (malware)"; content:"|11|concursos-peugeot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpaos.com (exploit)"; content:"|05|cpaos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daveshieldsphotography.com (koobface)"; content:"|16|daveshieldsphotography|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dd6s.zhuhc.cn (trojan)"; content:"|04|dd6s|05|zhuhc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddknet.biz (zeus/wsnpoem)"; content:"|06|ddknet|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debian.linux.org.pl (malware)"; content:"|06|debian|05|linux|03|org|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derekmohr.com (koobface)"; content:"|09|derekmohr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhjgjwgddve.com (malware)"; content:"|0b|dhjgjwgddve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhjvnvvddve.com (malware)"; content:"|0b|dhjvnvvddve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diaiscjdthr.com (neosploit)"; content:"|0b|diaiscjdthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalbluemultimedia.com (malware)"; content:"|15|digitalbluemultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctormiler.com (zeus/wsnpoem)"; content:"|0b|doctormiler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogshowonline.info (malware)"; content:"|0d|dogshowonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdflashworld.com (malware)"; content:"|0d|dvdflashworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwlmorss.dw.funpic.de (trojan)"; content:"|08|dwlmorss|02|dw|06|funpic|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejsinlbyidid.com (malware)"; content:"|0c|ejsinlbyidid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertriuanfhaeritruonceif.com (zeus/wsnpoem)"; content:"|17|ertriuanfhaeritruonceif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurosport.ueuo.com (zeus/wsnpoem)"; content:"|09|eurosport|04|ueuo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-pics.info (malware)"; content:"|0d|facebook-pics|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-pict.com (malware)"; content:"|0d|facebook-pict|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-pict.org (malware)"; content:"|0d|facebook-pict|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbcmfir.com (torpig)"; content:"|07|fbcmfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgxwuyyuno.com (malware)"; content:"|0a|fgxwuyyuno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhjslk21.org (zeus/wsnpoem)"; content:"|08|fhjslk21|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmtodata.com (malware)"; content:"|0a|filmtodata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findreliable.org (malware)"; content:"|0c|findreliable|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiwzv.net (zeus/wsnpoem)"; content:"|05|fiwzv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fjdc.edu.pk (koobface)"; content:"|04|fjdc|03|edu|02|pk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashmobvideos.com (malware)"; content:"|0e|flashmobvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fmcultura.com (malware)"; content:"|09|fmcultura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foreinternet.com (trojan)"; content:"|0c|foreinternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freedose.info (zeus/wsnpoem)"; content:"|08|freedose|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frondircass.cn (zeus/wsnpoem)"; content:"|0b|frondircass|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaddem.net (malware)"; content:"|06|gaddem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerbalaif.com (botnet_c&c)"; content:"|09|gerbalaif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gesohsohohtheegh.in (malware)"; content:"|10|gesohsohohtheegh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghedifauno.com (malware)"; content:"|0a|ghedifauno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalhead.net (trojan)"; content:"|0a|globalhead|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goninja.fastlearningbrain.com (koobface)"; content:"|07|goninja|11|fastlearningbrain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-statistics-uk.com (zeus/wsnpoem)"; content:"|14|google-statistics-uk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotsaved.cn (malware)"; content:"|08|gotsaved|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotsick.cn (malware)"; content:"|07|gotsick|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grahamscaner.cn (trojan)"; content:"|0c|grahamscaner|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatuk.org (zeus/wsnpoem)"; content:"|07|greatuk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grepsync.com (malware)"; content:"|08|grepsync|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greystoneofellijay.com (koobface)"; content:"|12|greystoneofellijay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdewptwhdve.com (malware)"; content:"|0b|hdewptwhdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herewereytinj.com (backdoor)"; content:"|0d|herewereytinj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermison.com (exploit)"; content:"|08|hermison|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhjvnzvhdve.com (malware)"; content:"|0b|hhjvnzvhdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homepcupdate.com (malware)"; content:"|0c|homepcupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hourbrand.com (rogue)"; content:"|09|hourbrand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inartdesigns.com (koobface)"; content:"|0c|inartdesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inroyal.info (oficla/sasfis)"; content:"|07|inroyal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup its-email.co.uk (koobface)"; content:"|09|its-email|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jfhsuu193c.net (fastflux)"; content:"|0a|jfhsuu193c|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kbclyokkthr.com (malware)"; content:"|0b|kbclyokkthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kdvarmgibtp.com (malware)"; content:"|0b|kdvarmgibtp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kissx.ru (malware)"; content:"|05|kissx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kokojamba.com (trojan)"; content:"|09|kokojamba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kornoval.in (exploit)"; content:"|08|kornoval|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lettsoiol.com (trojan)"; content:"|09|lettsoiol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lipesnaskom.com (zeus/wsnpoem)"; content:"|0b|lipesnaskom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logislat.com (zeus/wsnpoem)"; content:"|08|logislat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manyafa.com (zeus/wsnpoem)"; content:"|07|manyafa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcdcwjbmthr.com (malware)"; content:"|0b|mcdcwjbmthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalstoremm50.com (fastflux)"; content:"|10|medicalstoremm50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mennlyndy.com (malware)"; content:"|09|mennlyndy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghvegumthr.com (malware)"; content:"|0b|mghvegumthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milzvortex.info (malware)"; content:"|0a|milzvortex|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mioanali.com (exploit)"; content:"|08|mioanali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motoavto.limewebs.com (zeus/wsnpoem)"; content:"|08|motoavto|08|limewebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycleveridea.co.za (malware)"; content:"|0c|mycleveridea|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mydevnet.ca (trojan)"; content:"|08|mydevnet|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nastydealer.com (fastflux)"; content:"|0b|nastydealer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordrilskre.com (zeus/wsnpoem)"; content:"|0b|nordrilskre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nsboxdownblodmids.com (malware)"; content:"|11|nsboxdownblodmids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocgingenieria.es (malware)"; content:"|0d|ocgingenieria|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oooowor.com (malware)"; content:"|07|oooowor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openaskelisto.com (zeus/wsnpoem)"; content:"|0d|openaskelisto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opk-oil.ru (malware)"; content:"|07|opk-oil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ottalfight.com (rogue)"; content:"|0a|ottalfight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parter099.com (malware)"; content:"|09|parter099|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-carelive.com (rogue)"; content:"|0b|pc-carelive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-20-10.com (rogue)"; content:"|0e|pc-guard-20-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-guard-2010.com (rogue)"; content:"|0d|pc-guard-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-win-live-2010.com (rogue)"; content:"|10|pc-win-live-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-win-live.com (rogue)"; content:"|0b|pc-win-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-windows-live.com (rogue)"; content:"|0f|pc-windows-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-windowslive.com (rogue)"; content:"|0e|pc-windowslive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-winlive.com (rogue)"; content:"|0a|pc-winlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-winlive2010.com (rogue)"; content:"|0e|pc-winlive2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pccare-live.com (rogue)"; content:"|0b|pccare-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcguard-2010.com (rogue)"; content:"|0c|pcguard-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcguard20-10.com (rogue)"; content:"|0c|pcguard20-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcguard2010.com (rogue)"; content:"|0b|pcguard2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwin-live.com (rogue)"; content:"|0a|pcwin-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwindows-live.com (rogue)"; content:"|0e|pcwindows-live|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwindowslive.com (rogue)"; content:"|0d|pcwindowslive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwinlive-2010.com (rogue)"; content:"|0e|pcwinlive-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwinlive.com (rogue)"; content:"|09|pcwinlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcwinlive2010.com (rogue)"; content:"|0d|pcwinlive2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfgfgdepthr.com (malware)"; content:"|0b|pfgfgdepthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfgoykopdve.com (malware)"; content:"|0b|pfgoykopdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photos728.com (malware)"; content:"|09|photos728|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podmena.us (rogue)"; content:"|07|podmena|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prosolbones.com.br (malware)"; content:"|0b|prosolbones|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghgixfqthr.com (malware)"; content:"|0b|qghgixfqthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghvexuqthr.com (malware)"; content:"|0b|qghvexuqthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhjcwfbqthr.com (malware)"; content:"|0b|qhjcwfbqthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qlpkoxmdzxsb.com (malware)"; content:"|0c|qlpkoxmdzxsb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qnnualnews.com (malware)"; content:"|0a|qnnualnews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rezervzv.ru (exploit)"; content:"|08|rezervzv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rlosswe.com (trojan)"; content:"|07|rlosswe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romms.in (rootkit)"; content:"|05|romms|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup root.denirulz.org (malware)"; content:"|04|root|08|denirulz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salebogs.com (rogue)"; content:"|08|salebogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salebotw.com (rogue)"; content:"|08|salebotw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saleotu.com (trojan)"; content:"|07|saleotu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selectingimage.com (malware)"; content:"|0e|selectingimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setantanewmedia.com (malware)"; content:"|0f|setantanewmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjidamcsthr.com (malware)"; content:"|0b|sjidamcsthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sjinfcmsthr.com (malware)"; content:"|0b|sjinfcmsthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyfleck.com (trojan)"; content:"|08|skyfleck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavenkad.com (zeus/wsnpoem)"; content:"|09|slavenkad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socks5.real-host.ru (malware)"; content:"|06|socks5|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solaruploader.com (trojan)"; content:"|0d|solaruploader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space.facebook-pics.net (malware)"; content:"|05|space|0d|facebook-pics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-destroyerone.com (rogue)"; content:"|14|spyware-destroyerone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stationsecurity.com (trojan)"; content:"|0f|stationsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamlinemediaworks.com (zeus/wsnpoem)"; content:"|14|streamlinemediaworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stroimvmeste.in (malware)"; content:"|0c|stroimvmeste|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunbon.net (malware)"; content:"|06|sunbon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superlayout.org (zeus/wsnpoem)"; content:"|0b|superlayout|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagbuckets.com (trojan)"; content:"|0a|tagbuckets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tfgoyqotdve.com (malware)"; content:"|0b|tfgoyqotdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theppssshhhsd.info (malware)"; content:"|0d|theppssshhhsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thexxxclick.info (malware)"; content:"|0b|thexxxclick|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thundhack7.ref-host.com (malware)"; content:"|0a|thundhack7|08|ref-host|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiashostdve.com (malware)"; content:"|0b|tiashostdve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tieos.com (zeus/wsnpoem)"; content:"|05|tieos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topesuna.com (trojan)"; content:"|08|topesuna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tragicapple.com (rogue)"; content:"|0b|tragicapple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trastlifer.hk (zeus/wsnpoem)"; content:"|0a|trastlifer|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trstcam.com (trojan)"; content:"|07|trstcam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tttbbbttt.ru (malware)"; content:"|09|tttbbbttt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubetechltd.com (trojan)"; content:"|0b|tubetechltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucheba.ru (iframe)"; content:"|06|ucheba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uefxrwxudve.com (malware)"; content:"|0b|uefxrwxudve|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umor.sumy.ua (zeus/wsnpoem)"; content:"|04|umor|04|sumy|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unlockers122.info (zeus/wsnpoem)"; content:"|0c|unlockers122|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatesupportsystem.com (malware)"; content:"|13|updatesupportsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userfoto.com (malware)"; content:"|08|userfoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uyaryayincilik.com (malware)"; content:"|0e|uyaryayincilik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcipo.info (neosploit)"; content:"|05|vcipo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoinflash.com (malware)"; content:"|0c|videoinflash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viostudio.co.il (malware)"; content:"|09|viostudio|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivicohen.com.ar (koobface)"; content:"|09|vivicohen|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whoismak.net (zeus/wsnpoem)"; content:"|08|whoismak|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whydaddy.biz (botnet)"; content:"|08|whydaddy|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wildyourvideo.com (malware)"; content:"|0d|wildyourvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-defender-10.com (rogue)"; content:"|0f|win-defender-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-defender10.com (rogue)"; content:"|0e|win-defender10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windefender-10.com (rogue)"; content:"|0e|windefender-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-defender-10.com (rogue)"; content:"|13|windows-defender-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-defender10.com (rogue)"; content:"|12|windows-defender10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdefender-10.com (rogue)"; content:"|12|windowsdefender-10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsdefender10.com (rogue)"; content:"|11|windowsdefender10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldwidecard.net (malware)"; content:"|0d|worldwidecard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xartexfan.com (malware)"; content:"|09|xartexfan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yes-exploit-system.ru (exploit)"; content:"|12|yes-exploit-system|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygyg.net (zeus/wsnpoem)"; content:"|04|ygyg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylwgheakrozn.com (iframe)"; content:"|0c|ylwgheakrozn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmultimediaplayer.com (malware)"; content:"|14|yourmultimediaplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yvbbpgrixovr.com (malware)"; content:"|0c|yvbbpgrixovr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zannualnews.com (trojan)"; content:"|0b|zannualnews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeussave.comuv.com (zeus/wsnpoem)"; content:"|08|zeussave|05|comuv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zihabit.com (koobface)"; content:"|07|zihabit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 091809.ru (malware)"; content:"|06|091809|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1000sweeties.com (malware)"; content:"|0c|1000sweeties|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 522sm.com (threat)"; content:"|05|522sm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7zsm.com (malware)"; content:"|04|7zsm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aa419.ru (zeus)"; content:"|05|aa419|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aex.bij.pl (malware)"; content:"|03|aex|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afa.bij.pl (malware)"; content:"|03|afa|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agelis.ru (malware)"; content:"|06|agelis|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-winners-2010.com (malware)"; content:"|10|all-winners-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup all-winners-2010.ru (malware)"; content:"|10|all-winners-2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allwinners.cn (malware)"; content:"|0a|allwinners|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appzkeygen.com (malware)"; content:"|0a|appzkeygen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atualizetelecom.com.br (malware)"; content:"|0f|atualizetelecom|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auctionbid.biz (malware)"; content:"|0a|auctionbid|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banaling.com (malware)"; content:"|08|banaling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basesrv3.net (exploits_trojan_malware)"; content:"|08|basesrv3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected-10.info (scareware)"; content:"|0f|be-protected-10|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected-i8.info (scareware)"; content:"|0f|be-protected-i8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected-l0.info (scareware)"; content:"|0f|be-protected-l0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected-l1.info (scareware)"; content:"|0f|be-protected-l1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protected-t1.info (scareware)"; content:"|0f|be-protected-t1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protecteda.info (scareware)"; content:"|0d|be-protecteda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protectedc.info (scareware)"; content:"|0d|be-protectedc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protectedi.info (scareware)"; content:"|0d|be-protectedi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protectedk.info (scareware)"; content:"|0d|be-protectedk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-protectedy.info (scareware)"; content:"|0d|be-protectedy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured-a1.info (scareware)"; content:"|0d|be-secured-a1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured-b2.info (scareware)"; content:"|0d|be-secured-b2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured-c6.info (scareware)"; content:"|0d|be-secured-c6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured-d9.info (scareware)"; content:"|0d|be-secured-d9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup be-secured-z1.info (scareware)"; content:"|0d|be-secured-z1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protection0.info (scareware)"; content:"|10|best-protection0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protection8.info (scareware)"; content:"|10|best-protection8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protectiona.info (scareware)"; content:"|10|best-protectiona|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protectione.info (scareware)"; content:"|10|best-protectione|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-protectionf.info (scareware)"; content:"|10|best-protectionf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgoodstoree10.com (fastflux)"; content:"|10|bestgoodstoree10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgoodstoree11.com (fastflux)"; content:"|10|bestgoodstoree11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgoodstoree12.com (fastflux)"; content:"|10|bestgoodstoree12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgoodstoree15.com (fastflux)"; content:"|10|bestgoodstoree15|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgoodstoree7.com (fastflux)"; content:"|0f|bestgoodstoree7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestprotectiona.info (scareware)"; content:"|0f|bestprotectiona|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestprotectione.info (scareware)"; content:"|0f|bestprotectione|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttoolsonline.com (malware)"; content:"|0f|besttoolsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boydbusiness.com (threat)"; content:"|0c|boydbusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browsersecurecheck.com (harmful)"; content:"|12|browsersecurecheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chura.pl (malware)"; content:"|05|chura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citysupermedia.com (malware)"; content:"|0e|citysupermedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click-explorer.ir (malware)"; content:"|0e|click-explorer|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crysisanet.com (malware)"; content:"|0a|crysisanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d.twinrt.us (malware)"; content:"|01|d|06|twinrt|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doy-atmypc-to-clean.in (rogue)"; content:"|13|doy-atmypc-to-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doyatmypc-to-clean.in (rogue)"; content:"|12|doyatmypc-to-clean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duccomocco.org (malware)"; content:"|0a|duccomocco|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdtompegx.com (malware)"; content:"|0a|dvdtompegx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dybbuk.cz (rogue)"; content:"|06|dybbuk|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dywzhan.com (malware)"; content:"|07|dywzhan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebokeh.com (threat)"; content:"|06|ebokeh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup editorsfind.org (malware)"; content:"|0b|editorsfind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-pict.info (malware)"; content:"|0d|facebook-pict|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favoritenews.info (malware)"; content:"|0c|favoritenews|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenix2go.com (zeus)"; content:"|08|fenix2go|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileutiliteenligne.com (TrojanRenos)"; content:"|12|fileutiliteenligne|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileutilitevirtuel.com (TrojanRenos)"; content:"|12|fileutilitevirtuel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotossite.com (malware)"; content:"|09|fotossite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotostoday.com (malware)"; content:"|0a|fotostoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-adult-tube.org (malware)"; content:"|0f|free-adult-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewhois.ru (malware)"; content:"|09|freewhois|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnylive2010.ru (malware)"; content:"|0d|funnylive2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funymall.com (malware)"; content:"|08|funymall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-protection0.info (scareware)"; content:"|13|general-protection0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-protection1.info (scareware)"; content:"|13|general-protection1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-protection4.info (scareware)"; content:"|13|general-protection4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup general-protection9.info (scareware)"; content:"|13|general-protection9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getalestickets.com (scareware)"; content:"|0e|getalestickets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getbestshows.com (scareware)"; content:"|0c|getbestshows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gheeny.com (malware)"; content:"|06|gheeny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmen.pl (malware)"; content:"|07|goldmen|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomoneygo.info (malware)"; content:"|09|gomoneygo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-counter.org (malware)"; content:"|0e|google-counter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotconfused.cn (malware)"; content:"|0b|gotconfused|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gotonto.cn (malware)"; content:"|07|gotonto|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-you-now0.info (scareware)"; content:"|0d|help-you-now0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-you-now1.info (scareware)"; content:"|0d|help-you-now1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-you-now4.info (scareware)"; content:"|0d|help-you-now4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-you-now6.info (scareware)"; content:"|0d|help-you-now6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup help-you-now9.info (scareware)"; content:"|0d|help-you-now9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotbuynow.com (malware)"; content:"|09|hotbuynow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huaihuaren.com (malware)"; content:"|0a|huaihuaren|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoleaderus.biz (zeus)"; content:"|0c|infoleaderus|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jinzie.com (malware)"; content:"|06|jinzie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jisufvrr.com (malware)"; content:"|08|jisufvrr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwprotect.in (malware)"; content:"|09|kwprotect|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lookpike.com (malware)"; content:"|08|lookpike|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lykkelitenbarnehage.no (malspam)"; content:"|13|lykkelitenbarnehage|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makecashz.cn (malware)"; content:"|09|makecashz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masacote.ca (malware)"; content:"|08|masacote|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediagroupcode.com (malware)"; content:"|0e|mediagroupcode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaworksapp.com (malware)"; content:"|0d|mediaworksapp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieutilitesonline.com (malware)"; content:"|13|movieutilitesonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybotnet.org (malware)"; content:"|08|mybotnet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypcguard.co.kr (malware)"; content:"|09|mypcguard|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netnic.com.cn (malware)"; content:"|06|netnic|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networks.kpru.ac.th (malware)"; content:"|08|networks|04|kpru|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-fast-systemclean.in (rogue)"; content:"|14|new-fast-systemclean|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nic2session.com (rogue)"; content:"|0b|nic2session|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikavi.100free.com (malware)"; content:"|06|nikavi|07|100free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olivabrasil.com.br (malware)"; content:"|0b|olivabrasil|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opea.co.kr (flux)"; content:"|04|opea|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opee.or.kr (flux)"; content:"|04|opee|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palosantomare.com (malware)"; content:"|0d|palosantomare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pamilabrandi.dreamstation.com (malware)"; content:"|0c|pamilabrandi|0c|dreamstation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpserver.info (scareware)"; content:"|0c|pchelpserver|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpservera.info (scareware)"; content:"|0d|pchelpservera|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpserverz.info (scareware)"; content:"|0d|pchelpserverz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phatbootyfarm.com (malware)"; content:"|0d|phatbootyfarm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phya.yonsei.ac.kr (malware)"; content:"|04|phya|06|yonsei|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pickino.ru (malware)"; content:"|07|pickino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-pornmovie.info (malware)"; content:"|0e|play-pornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-pornovideo.info (malware)"; content:"|0f|play-pornovideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-pornvideo.info (malware)"; content:"|0e|play-pornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup play-pornvideos.info (malware)"; content:"|0f|play-pornvideos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporn-movie.info (malware)"; content:"|0e|playporn-movie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporn-movies.info (malware)"; content:"|0f|playporn-movies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporn-video.info (malware)"; content:"|0e|playporn-video|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporn-videos.info (malware)"; content:"|0f|playporn-videos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporno-movie.info (malware)"; content:"|0f|playporno-movie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporno-movies.info (malware)"; content:"|10|playporno-movies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporno-video.info (malware)"; content:"|0f|playporno-video|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playporno-videos.info (malware)"; content:"|10|playporno-videos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powersecurity09.info (scareware)"; content:"|0f|powersecurity09|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powersecurityc.info (scareware)"; content:"|0e|powersecurityc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powersecurityt.info (scareware)"; content:"|0e|powersecurityt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powersecurityy.info (scareware)"; content:"|0e|powersecurityy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerssoftware0.info (scareware)"; content:"|0f|powerssoftware0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerssoftware1.info (scareware)"; content:"|0f|powerssoftware1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerssoftware3.info (scareware)"; content:"|0f|powerssoftware3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerssoftware6.info (scareware)"; content:"|0f|powerssoftware6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primawega.com (malware)"; content:"|09|primawega|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pslicense.com (malware)"; content:"|09|pslicense|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvo-tut.net (malware)"; content:"|07|pvo-tut|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ratemypart.ru (threat)"; content:"|0a|ratemypart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redpenonline.ru (threat)"; content:"|0c|redpenonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regenye.net (threat)"; content:"|07|regenye|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reservc.cn (malware)"; content:"|07|reservc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roothostings.com (malware)"; content:"|0c|roothostings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rosagrofininvest.com (malware)"; content:"|10|rosagrofininvest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzaf.co.uk (flux)"; content:"|05|rxzaf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzak.me.uk (flux)"; content:"|05|rxzak|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzar.me.uk (flux)"; content:"|05|rxzar|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzat.me.uk (flux)"; content:"|05|rxzat|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzav.co.uk (flux)"; content:"|05|rxzav|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzax.co.uk (flux)"; content:"|05|rxzax|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxzax.me.uk (flux)"; content:"|05|rxzax|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saaremaa.ee (malware)"; content:"|08|saaremaa|02|ee"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sanmartinianovdr.org.ar (malware)"; content:"|10|sanmartinianovdr|03|org|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan1.my-computerz1.info (malware)"; content:"|05|scan1|0d|my-computerz1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servisbtl.if.ua (zeus)"; content:"|09|servisbtl|02|if|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slx777.com (malware)"; content:"|06|slx777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sobirin.webs.com (malware)"; content:"|07|sobirin|04|webs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somebodygot.cn (malware)"; content:"|0b|somebodygot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl-molotok.ru (malware)"; content:"|0b|ssl-molotok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-win-2010.com (malware)"; content:"|0e|super-win-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-win-2010.ru (malware)"; content:"|0e|super-win-2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superbobmovie.com (malware)"; content:"|0d|superbobmovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swanlake-show.de (threat)"; content:"|0d|swanlake-show|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenewbornof-clearpc.in (rogue)"; content:"|14|thenewbornof-clearpc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tigerden.uppit.com (malware)"; content:"|08|tigerden|05|uppit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tooothe.com (malware)"; content:"|07|tooothe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tornrubberpants.com (malware)"; content:"|0f|tornrubberpants|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ura-forclearpcnadspeed.in (rogue)"; content:"|16|ura-forclearpcnadspeed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uraforclear-pc-nadspeed.in (rogue)"; content:"|17|uraforclear-pc-nadspeed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vette-porno.nl (malware)"; content:"|0b|vette-porno|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viphack.biz (malware)"; content:"|07|viphack|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viphack.net (malware)"; content:"|07|viphack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vuvuhip.info (malware)"; content:"|07|vuvuhip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webspaceyou.net (malware)"; content:"|0b|webspaceyou|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wftguy.com (malware)"; content:"|06|wftguy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woiyu.com (malware)"; content:"|05|woiyu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workernew.cn (malware)"; content:"|09|workernew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--104-ep4e210o.tw (malware)"; content:"|10|xn--104-ep4e210o|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xstine.cn (malware)"; content:"|06|xstine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxx.sweetporn-movie.info (malware)"; content:"|03|xxx|0f|sweetporn-movie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesits-safenowfor-sure.in (rogue)"; content:"|16|yesits-safenowfor-sure|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z2oplusm.net (malware)"; content:"|08|z2oplusm|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zflaersroot.cn (malware)"; content:"|0b|zflaersroot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 100slonov.ru (malware)"; content:"|09|100slonov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5iyouxi.net (malicious)"; content:"|07|5iyouxi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeziochuweeshoce.in (malware)"; content:"|10|aeziochuweeshoce|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allevorun.biz (malware)"; content:"|09|allevorun|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazing-4-fotos.com (scareware)"; content:"|0f|amazing-4-fotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analitocs.com (malware)"; content:"|09|analitocs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup androidmobilereviews.com (scareware)"; content:"|14|androidmobilereviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup animezhd.com (malware)"; content:"|08|animezhd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apple-drink.com (harmful)"; content:"|0b|apple-drink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appledrink.net (harmful)"; content:"|0a|appledrink|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup argiento.eu (moneymule)"; content:"|08|argiento|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup banner2.casino.com (malware)"; content:"|07|banner2|06|casino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbcadditionalguide.com (scareware)"; content:"|12|bbcadditionalguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbs.97.cn (malware)"; content:"|03|bbs|02|97|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup berber2update.biz (malware)"; content:"|0d|berber2update|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttvshowininternet.com (scareware)"; content:"|14|besttvshowininternet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacktubes.in (malware)"; content:"|0a|blacktubes|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightonsales.com (scareware)"; content:"|0d|brightonsales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsanalytics.biz (malware)"; content:"|0b|bsanalytics|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-security1.info (scareware)"; content:"|11|capital-security1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-security2.info (scareware)"; content:"|11|capital-security2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-security6.info (scareware)"; content:"|11|capital-security6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-securitya.info (scareware)"; content:"|11|capital-securitya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-securityc.info (scareware)"; content:"|11|capital-securityc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-securitye.info (scareware)"; content:"|11|capital-securitye|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup capital-securityt.info (scareware)"; content:"|11|capital-securityt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkwebtriple.com (scareware)"; content:"|0e|checkwebtriple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chromepluginsfree.com (scareware)"; content:"|11|chromepluginsfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cml8.cn (driveby)"; content:"|04|cml8|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crymyway.com (malware)"; content:"|08|crymyway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily00photos.com (scareware)"; content:"|0d|daily00photos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily6deals.com (scareware)"; content:"|0b|daily6deals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daily88news.com (scareware)"; content:"|0b|daily88news|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davaydavay.net (malware)"; content:"|0a|davaydavay|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dellvideohacks.com (scareware)"; content:"|0e|dellvideohacks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverallnow.com (scareware)"; content:"|0e|discoverallnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverprivateinfo.com (scareware)"; content:"|13|discoverprivateinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverprivatelife.com (scareware)"; content:"|13|discoverprivatelife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverprivatemail.com (scareware)"; content:"|13|discoverprivatemail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverprivatewebcams.com (scareware)"; content:"|16|discoverprivatewebcams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoversecretdfacebook.com (scareware)"; content:"|17|discoversecretdfacebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duote.org (malware)"; content:"|05|duote|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eizuechijiabotho.in (malware)"; content:"|10|eizuechijiabotho|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eroticweb.ru (badware)"; content:"|09|eroticweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellenthitech.com (fakecodec)"; content:"|0f|excellenthitech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-pict.biz (malware)"; content:"|0d|facebook-pict|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-space.com (malware)"; content:"|0e|facebook-space|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookfriendwatch.com (scareware)"; content:"|13|facebookfriendwatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookreadmail.com (scareware)"; content:"|10|facebookreadmail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileserversl.com (malware)"; content:"|0c|fileserversl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-amazon-coupon.com (scareware)"; content:"|12|free-amazon-coupon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-ebay-stuff.com (scareware)"; content:"|0f|free-ebay-stuff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-secret-info.com (scareware)"; content:"|10|free-secret-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freevideos.osa.pl (fake_codec)"; content:"|0a|freevideos|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fridaytr.com (malware)"; content:"|08|fridaytr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fulllife2photo.com (scareware)"; content:"|0e|fulllife2photo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hightowerfisheye.com (scareware)"; content:"|10|hightowerfisheye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup how-to-secure-pc1.info (scareware)"; content:"|11|how-to-secure-pc1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iujoomaenoegeemi.in (malware)"; content:"|10|iujoomaenoegeemi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legomay.com (zeus)"; content:"|07|legomay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legomay.net (zeus)"; content:"|07|legomay|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legomay.org (zeus)"; content:"|07|legomay|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lenovovideohacks.com (scareware)"; content:"|10|lenovovideohacks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lineagecheatandbug.com (scareware)"; content:"|12|lineagecheatandbug|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mc-crew.org (malware)"; content:"|07|mc-crew|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-antivirus3.com (scareware)"; content:"|10|mega1-antivirus3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-antivirus5.com (scareware)"; content:"|10|mega1-antivirus5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-antivirus7.com (scareware)"; content:"|10|mega1-antivirus7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-antivirus9.com (scareware)"; content:"|10|mega1-antivirus9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-scanner5.com (scareware)"; content:"|0e|mega1-scanner5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega1-scanner7.com (scareware)"; content:"|0e|mega1-scanner7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megavids.org (zeus)"; content:"|08|megavids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mexicomaxtravel.com (scareware)"; content:"|0f|mexicomaxtravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftbugtracks.com (scareware)"; content:"|12|microsoftbugtracks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microstoreblog.com (scareware)"; content:"|0e|microstoreblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup migpix.com (zeus)"; content:"|06|migpix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup migpix.net (zeus)"; content:"|06|migpix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup migpix.org (zeus)"; content:"|06|migpix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modavedis.com (zeus)"; content:"|09|modavedis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modavedis.net (malware)"; content:"|09|modavedis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modavedis.org (zeus)"; content:"|09|modavedis|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymailbusiness.com (scareware)"; content:"|0e|mymailbusiness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocderrors.com (scareware)"; content:"|0a|nocderrors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkeroffers.com (scareware)"; content:"|0c|parkeroffers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partypartytime.com (scareware)"; content:"|0e|partypartytime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcx3.cn (malware)"; content:"|04|pcx3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portodrive.org (zeus)"; content:"|0a|portodrive|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup private-0-photos.com (scareware)"; content:"|10|private-0-photos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r2prod.com (malware)"; content:"|06|r2prod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reggiepix.com (zeus)"; content:"|09|reggiepix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reggiepix.net (malware)"; content:"|09|reggiepix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reggiepix.org (malware)"; content:"|09|reggiepix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzapix.com (zeus)"; content:"|08|regzapix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzapix.net (malware)"; content:"|08|regzapix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzapix.org (malware)"; content:"|08|regzapix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzavids.com (malware)"; content:"|09|regzavids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzavids.net (malware)"; content:"|09|regzavids|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regzavids.org (zeus)"; content:"|09|regzavids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restopix.org (zeus)"; content:"|08|restopix|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restpictures.com (zeus)"; content:"|0c|restpictures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restpictures.net (zeus)"; content:"|0c|restpictures|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restpictures.org (zeus)"; content:"|0c|restpictures|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restway.net (malware)"; content:"|07|restway|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restway.org (malware)"; content:"|07|restway|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securemyfield.com (rogue)"; content:"|0d|securemyfield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secureyourinfos.com (scareware)"; content:"|0f|secureyourinfos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwarec.info (scareware)"; content:"|12|security-softwarec|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seehiddenfacebook.com (scareware)"; content:"|11|seehiddenfacebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyscrapeviews.com (scareware)"; content:"|0e|skyscrapeviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-security1.info (scareware)"; content:"|0f|smart-security1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-securityo.info (scareware)"; content:"|0f|smart-securityo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecurity0.info (scareware)"; content:"|0e|smartsecurity0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecurity1.info (scareware)"; content:"|0e|smartsecurity1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecurity2.info (scareware)"; content:"|0e|smartsecurity2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecurity7.info (scareware)"; content:"|0e|smartsecurity7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecuritya.info (scareware)"; content:"|0e|smartsecuritya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsecurityd.info (scareware)"; content:"|0e|smartsecurityd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-helpa.info (scareware)"; content:"|0e|software-helpa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-helpd.info (scareware)"; content:"|0e|software-helpd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-helpe.info (scareware)"; content:"|0e|software-helpe|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-helpy.info (scareware)"; content:"|0e|software-helpy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-helpz.info (scareware)"; content:"|0e|software-helpz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-software1.info (scareware)"; content:"|11|special-software1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-software3.info (scareware)"; content:"|11|special-software3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-software7.info (scareware)"; content:"|11|special-software7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-software8.info (scareware)"; content:"|11|special-software8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup special-software9.info (scareware)"; content:"|11|special-software9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialwebhelp0.info (scareware)"; content:"|0f|specialwebhelp0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialwebhelp1.info (scareware)"; content:"|0f|specialwebhelp1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialwebhelp3.info (scareware)"; content:"|0f|specialwebhelp3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialwebhelp5.info (scareware)"; content:"|0f|specialwebhelp5|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup specialwebhelp7.info (scareware)"; content:"|0f|specialwebhelp7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super2-antivirus.com (scareware)"; content:"|10|super2-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super2-antivirus2.com (scareware)"; content:"|11|super2-antivirus2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tastyfiles.net (zeus)"; content:"|0a|tastyfiles|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technotrucks.net (zeus)"; content:"|0c|technotrucks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terraanews.com (scareware)"; content:"|0a|terraanews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themusicdynasty.com (harmful)"; content:"|0f|themusicdynasty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titanicoverlight.com (scareware)"; content:"|10|titanicoverlight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titansandgods.com (scareware)"; content:"|0d|titansandgods|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vampirizmu.net (malware)"; content:"|0a|vampirizmu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vedivids.com (malware)"; content:"|08|vedivids|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vedivids.net (malware)"; content:"|08|vedivids|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vedivids.org (malware)"; content:"|08|vedivids|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vediway.com (zeus)"; content:"|07|vediway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vediway.net (zeus)"; content:"|07|vediway|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vediway.org (zeus)"; content:"|07|vediway|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ver2-scanner.com (scareware)"; content:"|0c|ver2-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ver2-scanner2.com (scareware)"; content:"|0d|ver2-scanner2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ver2-scanner4.com (scareware)"; content:"|0d|ver2-scanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videostvshows.com (scareware)"; content:"|0d|videostvshows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waycity.net (harmful)"; content:"|07|waycity|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weddingiephotos.com (scareware)"; content:"|0f|weddingiephotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weddings-sales-place.com (scareware)"; content:"|14|weddings-sales-place|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wheretosellford.com (scareware)"; content:"|0f|wheretosellford|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoobusinesstrip.com (scareware)"; content:"|11|yahoobusinesstrip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you22tube.com (scareware)"; content:"|09|you22tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourblog2blog.com (scareware)"; content:"|0d|yourblog2blog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmaximumphoto.com (scareware)"; content:"|10|yourmaximumphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxjqbrijstkz.com (drivebydownload)"; content:"|0c|yxjqbrijstkz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1020cialistabs.ru (fastflux)"; content:"|0e|1020cialistabs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abugyhe.cn (malware)"; content:"|07|abugyhe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe7-jildyp.cn (malware)"; content:"|0d|adobe7-jildyp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afyopku.cn (malware)"; content:"|07|afyopku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahukyh.cn (malware)"; content:"|06|ahukyh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajoibe.cn (malware)"; content:"|06|ajoibe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akaelyr.cn (malware)"; content:"|07|akaelyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akebuop.cn (malware)"; content:"|07|akebuop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akouzo.cn (malware)"; content:"|06|akouzo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amuejgo.cn (malware)"; content:"|07|amuejgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-2010.org (threat)"; content:"|10|antimalware-2010|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-2010.ru (rogue)"; content:"|0c|antivir-2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anuyqve.cn (malware)"; content:"|07|anuyqve|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apuarym.cn (malware)"; content:"|07|apuarym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup australianslongevity.net (malware)"; content:"|14|australianslongevity|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-key.com (exploits)"; content:"|08|auto-key|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awyxeda.cn (malware)"; content:"|07|awyxeda|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axokawe.cn (malware)"; content:"|07|axokawe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup befreenet.com (malware)"; content:"|09|befreenet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betsyou.cn (malware)"; content:"|07|betsyou|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bodocweh.com (fastflux)"; content:"|08|bodocweh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup botezsu.cn (malware)"; content:"|07|botezsu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubiptet.com (fastflux)"; content:"|08|bubiptet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centre-essentiel.be (malware)"; content:"|10|centre-essentiel|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceqycfa.cn (malware)"; content:"|07|ceqycfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup challengevolley02.fr (malware)"; content:"|11|challengevolley02|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clean-up.kr (malware)"; content:"|08|clean-up|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearmindmultimedia.com (malware)"; content:"|13|clearmindmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comptoirdelhomme.com (malware)"; content:"|10|comptoirdelhomme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corpus-callosum.org (malware)"; content:"|0f|corpus-callosum|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creativesea.cn (malware)"; content:"|0b|creativesea|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demeuleneire.be (malware)"; content:"|0c|demeuleneire|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djg.be (exploits)"; content:"|03|djg|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsmom.com (exploits)"; content:"|05|dsmom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdhomemedia.com (malware)"; content:"|0c|dvdhomemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebyazro.cn (malware)"; content:"|07|ebyazro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edigitalwidgets.com (trojanrenos)"; content:"|0f|edigitalwidgets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eflashmedia.com (malware)"; content:"|0b|eflashmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efoelug.cn (malware)"; content:"|07|efoelug|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egaxies.cn (malware)"; content:"|07|egaxies|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egycaew.cn (malware)"; content:"|07|egycaew|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekiozet.cn (malware)"; content:"|07|ekiozet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewuafi.cn (malware)"; content:"|06|ewuafi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellentartsonline.com (malware)"; content:"|13|excellentartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exezaho.cn (malware)"; content:"|07|exezaho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-id.com (malware)"; content:"|0b|facebook-id|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-id.us (malspam)"; content:"|0b|facebook-id|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttopblog.cn (malware)"; content:"|0b|fasttopblog|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fizhox.cn (malware)"; content:"|06|fizhox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashmovieonline.com (trojanrenos)"; content:"|10|flashmovieonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fyqtewa.cn (malware)"; content:"|07|fyqtewa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gapongi.cn (malware)"; content:"|07|gapongi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gazinafis.com (malware)"; content:"|09|gazinafis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenliontech.com (malware)"; content:"|0e|goldenliontech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldrushphone.cn (malware)"; content:"|0d|goldrushphone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodtabletsonline.ru (fastflux)"; content:"|11|goodtabletsonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup groupsweb.cn (malware)"; content:"|09|groupsweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup handharmony.cn (malware)"; content:"|0b|handharmony|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup havirfy.cn (malware)"; content:"|07|havirfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hefnody.cn (malware)"; content:"|07|hefnody|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hejaza.cn (malware)"; content:"|06|hejaza|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhaf.org (malware)"; content:"|04|hhaf|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeformedia.com (trojanrenos)"; content:"|0c|homeformedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homemulti.cn (malware)"; content:"|09|homemulti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houstonhotelreal.com (malware)"; content:"|10|houstonhotelreal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iaoszusuowxv.info (threat)"; content:"|0c|iaoszusuowxv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieatvaginas.com (malware)"; content:"|0b|ieatvaginas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imiwuvo.cn (malware)"; content:"|07|imiwuvo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ineajot.cn (malware)"; content:"|07|ineajot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inspatia.com (malware)"; content:"|08|inspatia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetbox.it (malware)"; content:"|0b|internetbox|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ixaonke.cn (malware)"; content:"|07|ixaonke|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyron.com (threat)"; content:"|05|jyron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jyzhaje.cn (malware)"; content:"|07|jyzhaje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kionasa.net (fastflux)"; content:"|07|kionasa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lampfrenzy.cn (malware)"; content:"|0a|lampfrenzy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lebisuf.cn (malware)"; content:"|07|lebisuf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifohva.cn (malware)"; content:"|07|lifohva|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightobmen.ru (malware)"; content:"|0a|lightobmen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ligpeos.cn (malware)"; content:"|07|ligpeos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linhaky.cn (malware)"; content:"|07|linhaky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkpilots.com (malware)"; content:"|0a|linkpilots|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liqedjo.cn (malware)"; content:"|07|liqedjo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liwgabe.cn (malware)"; content:"|07|liwgabe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lojzaqu.cn (malware)"; content:"|07|lojzaqu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loninols.com (exploits)"; content:"|08|loninols|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loootamaria.com (malware)"; content:"|0b|loootamaria|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotuscovecampground.com (malware)"; content:"|13|lotuscovecampground|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovpiny.cn (malware)"; content:"|07|lovpiny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luljeco.cn (malware)"; content:"|07|luljeco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luqfeoh.cn (malware)"; content:"|07|luqfeoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lytucak.cn (malware)"; content:"|07|lytucak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marcin-peintures.com (malware)"; content:"|10|marcin-peintures|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaatmedia.com (trojanrenos)"; content:"|0c|mediaatmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadatalimited.com (malware)"; content:"|10|mediadatalimited|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadataonline.com (malware)"; content:"|0f|mediadataonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediapcsoftware.com (trojanrenos)"; content:"|0f|mediapcsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaprogrammet.com (trojanrenos)"; content:"|0f|mediaprogrammet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediastorageinfo.com (trojanrenos)"; content:"|10|mediastorageinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaspl.net (malware)"; content:"|07|megaspl|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup misgyow.cn (malware)"; content:"|07|misgyow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mooseroutdoors.com.au (malware)"; content:"|0e|mooseroutdoors|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moreporno-movies.info (malware)"; content:"|10|moreporno-movies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mucdoab.cn (malware)"; content:"|07|mucdoab|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediadigitalvideo.com (malware)"; content:"|16|multimediadigitalvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediaplanete.com (trojanrenos)"; content:"|11|multimediaplanete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimediautilitesprojet.com (malware)"; content:"|18|multimediautilitesprojet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muvsad.cn (malware)"; content:"|06|muvsad|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylsoec.cn (malware)"; content:"|07|mylsoec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myqvaic.cn (malware)"; content:"|07|myqvaic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywebserver.ir (malware)"; content:"|0b|mywebserver|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n-pills.com (exploits)"; content:"|07|n-pills|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newcenturymultimedia.com (malware)"; content:"|14|newcenturymultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhorizonsmultimedia.com (malware)"; content:"|15|newhorizonsmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newmacromedia.com (malware)"; content:"|0d|newmacromedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nordeasniris.com (malicious)"; content:"|0c|nordeasniris|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notebook.sonyvaios.info (malware)"; content:"|08|notebook|09|sonyvaios|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntas.com (malware)"; content:"|04|ntas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nudlkasnuls.com (malware)"; content:"|0b|nudlkasnuls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obejoys.cn (malware)"; content:"|07|obejoys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oloibge.cn (malware)"; content:"|07|oloibge|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omega365.ru (malware)"; content:"|08|omega365|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omuahed.cn (malware)"; content:"|07|omuahed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opa-opa-nixuya.net (malware)"; content:"|0e|opa-opa-nixuya|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opyaxa.cn (malware)"; content:"|06|opyaxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oseihna.cn (malware)"; content:"|07|oseihna|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otumagi.cn (malware)"; content:"|07|otumagi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup outstandingsports.eu (malware)"; content:"|11|outstandingsports|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paginebusiness.it (malware)"; content:"|0e|paginebusiness|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phonegoldrush.cn (malware)"; content:"|0d|phonegoldrush|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivozec.cn (malware)"; content:"|07|pivozec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powertreecorp.com (malware)"; content:"|0d|powertreecorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qormyv.cn (malware)"; content:"|06|qormyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rareartonline.com (malware)"; content:"|0d|rareartonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rementur.cn (malware)"; content:"|08|rementur|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resenboernehave.dk (malware)"; content:"|0f|resenboernehave|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reviewsfinance.cn (malware)"; content:"|0e|reviewsfinance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rupartner.net (malware)"; content:"|09|rupartner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sambawafarms.com (malware)"; content:"|0c|sambawafarms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smilecourage.cn (malware)"; content:"|0c|smilecourage|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superflashshow.com (trojanrenos)"; content:"|0e|superflashshow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tabpharmacy.cn (malware)"; content:"|0b|tabpharmacy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tibemka.cn (malware)"; content:"|07|tibemka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolboxhome.cn (malware)"; content:"|0b|toolboxhome|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufouqib.cn (malware)"; content:"|07|ufouqib|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ugolyxa.cn (malware)"; content:"|07|ugolyxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ukyfeuw.cn (malware)"; content:"|07|ukyfeuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatewo.org (rogue)"; content:"|08|updatewo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urosina.cn (malware)"; content:"|07|urosina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uwdag.be (malware)"; content:"|05|uwdag|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veterinariancare.us (malware)"; content:"|10|veterinariancare|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videodatavoice.com (trojanrenos)"; content:"|0e|videodatavoice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voorpov.com (exploits)"; content:"|07|voorpov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winemanz.com (exploits)"; content:"|08|winemanz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wirefreemultimedia.com (trojanrenos)"; content:"|12|wirefreemultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wufimo.cn (malware)"; content:"|06|wufimo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xicgoku.cn (malware)"; content:"|07|xicgoku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xicp.cn (exploit)"; content:"|04|xicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xojede.cn (malware)"; content:"|06|xojede|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xooimage.com (malware)"; content:"|08|xooimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycauqel.cn (malware)"; content:"|07|ycauqel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ycuexe.cn (malware)"; content:"|06|ycuexe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ydugoh.cn (malware)"; content:"|06|ydugoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yjevuwy.cn (malware)"; content:"|07|yjevuwy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylomiz.cn (malware)"; content:"|06|ylomiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourartmuseum.com (malware)"; content:"|0d|yourartmuseum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourdesignart.com (fastflux)"; content:"|0d|yourdesignart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxieluz.cn (malware)"; content:"|07|yxieluz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zezmah.cn (malware)"; content:"|06|zezmah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zopyfa.cn (malware)"; content:"|06|zopyfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuchiom.cn (malware)"; content:"|07|zuchiom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdulabah.cn (malware)"; content:"|09|abdulabah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecurityshield.com (harmful)"; content:"|14|activesecurityshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobe-best-software.biz (malware)"; content:"|13|adobe-best-software|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adult-tube-downloads.net (harmful)"; content:"|14|adult-tube-downloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alinaturu.info (malware)"; content:"|09|alinaturu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altitude-groupli.com (moneymule)"; content:"|10|altitude-groupli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alwyn-groupllc.com (moneymule)"; content:"|0e|alwyn-groupllc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amplitude-groupmain.net (moneymule)"; content:"|13|amplitude-groupmain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ant-yvirusstore.net (malware)"; content:"|0f|ant-yvirusstore|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-solution.com (malware)"; content:"|14|antispyware-solution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareupdatesystem.com (harmful)"; content:"|17|antispywareupdatesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antitake.co.cc (malware)"; content:"|08|antitake|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-online.co.cc (malware)"; content:"|0e|antivir-online|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anynewmedia.com (malware)"; content:"|0b|anynewmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asperity-group.com (moneymule)"; content:"|0e|asperity-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asperitygroup.net (moneymule)"; content:"|0d|asperitygroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astraporntube.com (malware)"; content:"|0d|astraporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augment-group.com (moneymule)"; content:"|0d|augment-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augment-groupmain.tw (moneymule)"; content:"|11|augment-groupmain|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup augmentgroup.net (moneymule)"; content:"|0c|augmentgroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-saloon.info (malware)"; content:"|0b|auto-saloon|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-groups.net (malware)"; content:"|09|av-groups|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avchecks.com (malware)"; content:"|08|avchecks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidu-1163.cn (harmful)"; content:"|0a|baidu-1163|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bankitrade.com (harmful)"; content:"|0a|bankitrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdbdbddbdddbdd.cn (harmful)"; content:"|0e|bdbdbddbdddbdd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdsmteacher.com (malware)"; content:"|0b|bdsmteacher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellezkino.biz (harmful)"; content:"|0a|bellezkino|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best6scan.info (harmful)"; content:"|09|best6scan|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestpicturemedia.cn (malware)"; content:"|10|bestpicturemedia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsecurityupdate.com (harmful)"; content:"|12|bestsecurityupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsocks5servise.com (malware)"; content:"|11|bestsocks5servise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsoftwware.com (malware)"; content:"|0d|bestsoftwware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beststabilityscans.com (harmful)"; content:"|12|beststabilityscans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigdefense2u.cn (harmful)"; content:"|0c|bigdefense2u|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopescorts.cn (harmful)"; content:"|0d|bigtopescorts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup binverse.com (malware)"; content:"|08|binverse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluelife.co.in (malware)"; content:"|08|bluelife|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonusmediafile.com (malware)"; content:"|0e|bonusmediafile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup briers.info (malware)"; content:"|06|briers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup california.podzemlje.net (malware)"; content:"|0a|california|09|podzemlje|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinobigtop.cn (harmful)"; content:"|0c|casinobigtop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinoslotbet.cn (malware)"; content:"|0d|casinoslotbet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celerity-groupmain.net (moneymule)"; content:"|12|celerity-groupmain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celerity-groupmain.tw (moneymule)"; content:"|12|celerity-groupmain|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celeritygroupmain.tw (moneymule)"; content:"|11|celeritygroupmain|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkonlinesecurity.com (harmful)"; content:"|13|checkonlinesecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolnameshop.cn (harmful)"; content:"|0c|coolnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curtal.info (malware)"; content:"|06|curtal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daddybigtop.cn (harmful)"; content:"|0b|daddybigtop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup data6scan.com (harmful)"; content:"|09|data6scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dddbbbddbbdbd.cn (harmful)"; content:"|0d|dddbbbddbbdbd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktoppcdefender.net (malware)"; content:"|11|desktoppcdefender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup detiinfo.ru (malware)"; content:"|08|detiinfo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhsinfo.info (malware)"; content:"|07|dhsinfo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhsorg.org (malware)"; content:"|06|dhsorg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donwload-oem.com (malware)"; content:"|0c|donwload-oem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.spyware-secure.com (malware)"; content:"|08|download|0e|spyware-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easydefenseonline.cn (harmful)"; content:"|11|easydefenseonline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epaymentprocess.com (malware)"; content:"|0f|epaymentprocess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup es6-scripts.dlv4.com (malware)"; content:"|0b|es6-scripts|04|dlv4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etyj.ru (harmful)"; content:"|04|etyj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evatpe.com (malware)"; content:"|06|evatpe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-groupsvc.com (moneymule)"; content:"|0e|excel-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup explosivewarez.info (malware)"; content:"|0e|explosivewarez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expresssoftwarepayment.com (malware)"; content:"|16|expresssoftwarepayment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expuls.info (malware)"; content:"|06|expuls|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasthelpcenter.com (malware)"; content:"|0e|fasthelpcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscanyourpc.com (malware)"; content:"|0e|fastscanyourpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fecunda-group.com (moneymule)"; content:"|0d|fecunda-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fecunda-groupmain.net (moneymule)"; content:"|11|fecunda-groupmain|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fecunda-groupmain.tw (moneymule)"; content:"|11|fecunda-groupmain|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmworldinc.com (malware)"; content:"|0c|filmworldinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firststategymnastics.com (threat)"; content:"|14|firststategymnastics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashsecurity.ru (zeus)"; content:"|0d|flashsecurity|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foreaim-group.com (moneymule)"; content:"|0d|foreaim-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foreaimgroup.net (moneymule)"; content:"|0c|foreaimgroup|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fr4-network.nocreditcard.com (malware)"; content:"|0b|fr4-network|0c|nocreditcard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup furniture-style.info (malware)"; content:"|0f|furniture-style|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdemoebablo.com (malware)"; content:"|0b|gdemoebablo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generalscansite.com (malware)"; content:"|0f|generalscansite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogle.com.hk (malware)"; content:"|05|gogle|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golden-gateco.net (moneymule)"; content:"|0d|golden-gateco|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golden-gateinc.com (moneymule)"; content:"|0e|golden-gateinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleadserver.com (harmful)"; content:"|0e|googleadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googli.us (harmful)"; content:"|06|googli|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goooogleadsence.biz (harmful)"; content:"|0f|goooogleadsence|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goooogleadsence.com (harmful)"; content:"|0f|goooogleadsence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosomescan.com (malware)"; content:"|0a|gosomescan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandtraf.com (harmful)"; content:"|09|grandtraf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatsecurityshield.com (harmful)"; content:"|13|greatsecurityshield|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greendayss.com (malware)"; content:"|0a|greendayss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greylogic.info (malware)"; content:"|09|greylogic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haoxia18.com (harmful)"; content:"|08|haoxia18|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup how-to-secure-pc0.info (malware)"; content:"|11|how-to-secure-pc0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup how-to-secure-pc7.info (malware)"; content:"|11|how-to-secure-pc7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup how-to-secure-pc9.info (malware)"; content:"|11|how-to-secure-pc9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugetopnonfat.cn (harmful)"; content:"|0d|hugetopnonfat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iframedialer.com (malware)"; content:"|0c|iframedialer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2608219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impact-groupinc.net (moneymule)"; content:"|0f|impact-groupinc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impact-groupnet.com (moneymule)"; content:"|0f|impact-groupnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inetsecuritycenter.com (harmful)"; content:"|12|inetsecuritycenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intelfusion.info (malware)"; content:"|0b|intelfusion|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interinetskim.com (harmful)"; content:"|0d|interinetskim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internet-antivirus-pro.com (harmful)"; content:"|16|internet-antivirus-pro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetdefence1.at (malware)"; content:"|10|internetdefence1|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup it-sec.webege.com (zeus)"; content:"|06|it-sec|06|webege|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jackzard.110mb.com (malware)"; content:"|08|jackzard|05|110mb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klaipedetis.com (malware)"; content:"|0b|klaipedetis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klaratsetkin.info (malware)"; content:"|0c|klaratsetkin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komerkez.tk (malware)"; content:"|08|komerkez|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lenaivanova.info (malware)"; content:"|0b|lenaivanova|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linksonline.in (zeus)"; content:"|0b|linksonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listenz.org (malware)"; content:"|07|listenz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteautofinestsite.cn (harmful)"; content:"|12|liteautofinestsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litedownloadfinest.cn (harmful)"; content:"|12|litedownloadfinest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litehitscar.cn (harmful)"; content:"|0b|litehitscar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logisticservices.info (malware)"; content:"|10|logisticservices|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longed.info (malware)"; content:"|06|longed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotbetsite.cn (harmful)"; content:"|0a|lotbetsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotbetworld.cn (harmful)"; content:"|0b|lotbetworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotwageronline.cn (harmful)"; content:"|0e|lotwageronline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpm.mgroup.pl (malware)"; content:"|03|lpm|06|mgroup|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsnzroafntm.com (malware)"; content:"|0b|lsnzroafntm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luisababa.com.cn (harmful)"; content:"|09|luisababa|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxor-groupco.tw (moneymule)"; content:"|0d|luxor-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxor-groupinc.tw (moneymule)"; content:"|0e|luxor-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup market2all.org (malware)"; content:"|0a|market2all|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mayatek.info (malware)"; content:"|07|mayatek|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediamovieworks.com (malware)"; content:"|0f|mediamovieworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mehrcodecmedia.com (malware)"; content:"|0e|mehrcodecmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metalteam.org (malware)"; content:"|09|metalteam|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfgfgkemthr.com (malware)"; content:"|0b|mfgfgkemthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milicija.org (malware)"; content:"|08|milicija|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviestarplus.com (malware)"; content:"|0d|moviestarplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myabcd.info (threat)"; content:"|06|myabcd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myant-yvirus.net (malware)"; content:"|0c|myant-yvirus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myrx8.net (harmful)"; content:"|05|myrx8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysscan.com (harmful)"; content:"|07|mysscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myxp.info (malware)"; content:"|04|myxp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naked-elves.com (malware)"; content:"|0b|naked-elves|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nccmicropayment.com (malware)"; content:"|0f|nccmicropayment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup news-blog.biz (harmful)"; content:"|09|news-blog|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niceday2steal.in (zbot)"; content:"|0d|niceday2steal|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocreditcard.com (malware)"; content:"|0c|nocreditcard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2600593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nocreditcardgay.com (malware)"; content:"|0f|nocreditcardgay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2608428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novawarez.org (malware)"; content:"|09|novawarez|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup office2008online.com (malware)"; content:"|10|office2008online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofgaqxyothr.com (malware)"; content:"|0b|ofgaqxyothr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcantimalwaresolution.com (rogue_malware)"; content:"|15|pcantimalwaresolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpserver2.info (malware)"; content:"|0d|pchelpserver2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpserver9.info (malware)"; content:"|0d|pchelpserver9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpservero.info (malware)"; content:"|0d|pchelpservero|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpserverw.info (malware)"; content:"|0d|pchelpserverw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpsoftware4.info (malware)"; content:"|0f|pchelpsoftware4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpsoftware7.info (malware)"; content:"|0f|pchelpsoftware7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpsoftware8.info (malware)"; content:"|0f|pchelpsoftware8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pchelpsoftwarez.info (malware)"; content:"|0f|pchelpsoftwarez|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup platnuki.ru (zeus)"; content:"|08|platnuki|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pleaseclickhere.cn (harmful)"; content:"|0f|pleaseclickhere|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plusmediadata.com (malware)"; content:"|0d|plusmediadata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornflashgalls.com (malware)"; content:"|0e|pornflashgalls|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pravoved.pl.ua (zeus)"; content:"|08|pravoved|02|pl|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proteus-solutions-ltd.com (malware)"; content:"|15|proteus-solutions-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proteus-solutions-ltd.org (malware)"; content:"|15|proteus-solutions-ltd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qq163-eild.cn (harmful)"; content:"|0a|qq163-eild|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qqnn.net (harmful)"; content:"|04|qqnn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramualdo.com (harmful)"; content:"|08|ramualdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmediaworld.com (malware)"; content:"|0e|realmediaworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regantivirus.com (harmful)"; content:"|0c|regantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubenvaneeckhout.com (malware)"; content:"|10|rubenvaneeckhout|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan4best.info (harmful)"; content:"|09|scan4best|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan6main.com (harmful)"; content:"|09|scan6main|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan6tool.com (harmful)"; content:"|09|scan6tool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanweb4.info (harmful)"; content:"|08|scanweb4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searcharthur.org (malware)"; content:"|0c|searcharthur|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securedz.com (malware)"; content:"|08|securedz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-site1.info (malware)"; content:"|0e|security-site1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-site3.info (malware)"; content:"|0e|security-site3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-site5.info (malware)"; content:"|0e|security-site5|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwarea.info (malware)"; content:"|12|security-softwarea|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwaree.info (malware)"; content:"|12|security-softwaree|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-softwarey.info (malware)"; content:"|12|security-softwarey|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security1tutorial.com (malware)"; content:"|11|security1tutorial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial03.com (malware)"; content:"|12|securitytutorial03|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial05.com (malware)"; content:"|12|securitytutorial05|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial07.com (malware)"; content:"|12|securitytutorial07|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial1a.com (malware)"; content:"|12|securitytutorial1a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial3a.com (malware)"; content:"|12|securitytutorial3a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial5a.com (malware)"; content:"|12|securitytutorial5a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial7a.com (malware)"; content:"|12|securitytutorial7a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitytutorial8a.com (malware)"; content:"|12|securitytutorial8a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexpofreeporn.com (malware)"; content:"|0d|sexpofreeporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snzxrjelgsw.com (malware)"; content:"|0b|snzxrjelgsw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spamhaus.su (malware)"; content:"|08|spamhaus|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spark-groupsvc.com (moneymule)"; content:"|0e|spark-groupsvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyenemy.com (malware)"; content:"|08|spyenemy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-secure.com (malware)"; content:"|0e|spyware-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarepc.info (malware)"; content:"|09|spywarepc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srazuregnu.com (malware)"; content:"|0a|srazuregnu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats.nocreditcard.com (malware)"; content:"|05|stats|0c|nocreditcard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stepscan6.com (harmful)"; content:"|09|stepscan6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storeoffers.info (malware)"; content:"|0b|storeoffers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storyfold.info (malware)"; content:"|09|storyfold|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strantgre.info (malware)"; content:"|09|strantgre|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stratix.info (malware)"; content:"|07|stratix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stripplayer.com (malware)"; content:"|0b|stripplayer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2601185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-win2010.ru (malware)"; content:"|0d|super-win2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superpuperss.com (malware)"; content:"|0c|superpuperss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersecuritys.net (malware)"; content:"|0e|supersecuritys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swwatch.com (malware)"; content:"|07|swwatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup synapse-groupfine.net (moneymule)"; content:"|11|synapse-groupfine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup synapse-groupinc.tw (moneymule)"; content:"|10|synapse-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup synapsegroupli.com (moneymule)"; content:"|0e|synapsegroupli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamadaporntube.com (malware)"; content:"|0e|tamadaporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techno-worlds.info (malware)"; content:"|0d|techno-worlds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terrificmultimedia.net (malware)"; content:"|12|terrificmultimedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tnmgroupinc.com (moneymule)"; content:"|0b|tnmgroupinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tnmgroupsvc.net (moneymule)"; content:"|0b|tnmgroupsvc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup total-defender.com (scareware)"; content:"|0e|total-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup total-scan.net (malware)"; content:"|0a|total-scan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trueworldmedia.net (malware)"; content:"|0e|trueworldmedia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttt20091124.info (threat)"; content:"|0b|ttt20091124|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unmast.info (malware)"; content:"|06|unmast|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videostreamworks.com (malware)"; content:"|10|videostreamworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidkonsultant.com (malware)"; content:"|0d|vidkonsultant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viralvideos.org (malware)"; content:"|0b|viralvideos|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viruscaner.com (malware)"; content:"|0a|viruscaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez-downloads.org (malware)"; content:"|0f|warez-downloads|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez-vn.net (malware)"; content:"|08|warez-vn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warez-warez.com (malware)"; content:"|0b|warez-warez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezcentralz.com (malware)"; content:"|0d|warezcentralz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezcrackserial.com (malware)"; content:"|10|warezcrackserial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezdatabase.com (malware)"; content:"|0d|warezdatabase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wbot.in (malware)"; content:"|04|wbot|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websscan.com (harmful)"; content:"|08|websscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westendgroupsvc.net (moneymule)"; content:"|0f|westendgroupsvc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win-protection.info (malware)"; content:"|0e|win-protection|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win2protection.info (malware)"; content:"|0e|win2protection|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win4protection.info (malware)"; content:"|0e|win4protection|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup win9protection.info (malware)"; content:"|0e|win9protection|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotection-1.info (malware)"; content:"|0f|winprotection-1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotection-3.info (malware)"; content:"|0f|winprotection-3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotection-9.info (malware)"; content:"|0f|winprotection-9|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotection-e.info (malware)"; content:"|0f|winprotection-e|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotectiona.info (malware)"; content:"|0e|winprotectiona|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotectionw.info (malware)"; content:"|0e|winprotectionw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xnasax.com (malware)"; content:"|06|xnasax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoo-statistic.com (malware)"; content:"|0f|yahoo-statistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zalipuka.com (malware)"; content:"|08|zalipuka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-pro-live-scan.com (harmful)"; content:"|17|antivirus-pro-live-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusonlineproscan.com (harmful)"; content:"|16|antivirusonlineproscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusonlineproscanner.com (harmful)"; content:"|19|antivirusonlineproscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aoc8.com (harmful)"; content:"|04|aoc8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counnter.cn (harmful)"; content:"|08|counnter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liteautogreatest.cn (harmful)"; content:"|10|liteautogreatest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhdiw.com (exploit)"; content:"|05|nhdiw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceandealer.cn (harmful)"; content:"|0b|oceandealer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinedetect.com (harmful)"; content:"|0c|onlinedetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peopleopera.cn (harmful)"; content:"|0b|peopleopera|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pub.oceandealer.cn (harmful)"; content:"|03|pub|0b|oceandealer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rainfinish.cn (harmful)"; content:"|0a|rainfinish|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumblar.cn (harmful)"; content:"|07|gumblar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1004bang.net (malware)"; content:"|08|1004bang|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12circles.de (malware)"; content:"|09|12circles|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-deals.com (rogue)"; content:"|0a|7day-deals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-discounts.com (rogue)"; content:"|0e|7day-discounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-flavours.com (rogue)"; content:"|0d|7day-flavours|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-gifts.com (rogue)"; content:"|0a|7day-gifts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7day-trips.com (rogue)"; content:"|0a|7day-trips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ablameyko.ru (malware)"; content:"|09|ablameyko|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup about-blank-my-computer-scanner.org (Trojan )"; content:"|1f|about-blank-my-computer-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adlt2010.w2c.ru (malware)"; content:"|08|adlt2010|03|w2c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aforistiseni.com (malware)"; content:"|0c|aforistiseni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agencedelamairie.fr (malware)"; content:"|10|agencedelamairie|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghveruathr.com (malware)"; content:"|0b|aghveruathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aionfreeaccounts.com (rogue)"; content:"|10|aionfreeaccounts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajidafcathr.com (malware)"; content:"|0b|ajidafcathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allgirlsvideos2.com (malware)"; content:"|0f|allgirlsvideos2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allmarketsecrets.com (rogue)"; content:"|10|allmarketsecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup altogm.com (malware)"; content:"|06|altogm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazon2secrets.com (rogue)"; content:"|0e|amazon2secrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-top2010.com (Trojan )"; content:"|13|antispyware-top2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarecor.com (Trojan )"; content:"|0e|antispywarecor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywaretop2010.com (Trojan )"; content:"|12|antispywaretop2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviral-pluss.org (rogue)"; content:"|0f|antiviral-pluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviralpluss.org (rogue)"; content:"|0e|antiviralpluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirs-pluss.org (rogue)"; content:"|0e|antivirs-pluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirspluss.org (rogue)"; content:"|0d|antivirspluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviru-pluss.org (rogue)"; content:"|0e|antiviru-pluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirupluss.org (rogue)"; content:"|0d|antivirupluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-p1uss.org (rogue)"; content:"|0f|antivirus-p1uss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arvina-groupco.tw (moneymule)"; content:"|0e|arvina-groupco|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arvina-groupinc.tw (moneymule)"; content:"|0f|arvina-groupinc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arvina-groupnet.cc (moneymule)"; content:"|0f|arvina-groupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aureatemultimedia.com (malware)"; content:"|11|aureatemultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-onlinescanner.org (rogue)"; content:"|10|av-onlinescanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinefairy.org (rogue)"; content:"|15|av-scaner-onlinefairy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinehistory.org (rogue)"; content:"|17|av-scaner-onlinehistory|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineicity.org (rogue)"; content:"|15|av-scaner-onlineicity|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinemachine.org (rogue)"; content:"|17|av-scaner-onlinemachine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinepeople.org (rogue)"; content:"|16|av-scaner-onlinepeople|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineretort.org (rogue)"; content:"|16|av-scaner-onlineretort|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinereview.org (rogue)"; content:"|16|av-scaner-onlinereview|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinetopia.org (rogue)"; content:"|15|av-scaner-onlinetopia|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avonlinescanerr.org (rogue)"; content:"|0f|avonlinescanerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avonlinescanner.org (rogue)"; content:"|0f|avonlinescanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avonlinescannerr.org (rogue)"; content:"|10|avonlinescannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avp-scanner.org (rogue)"; content:"|0b|avp-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avp-scannerr.org (rogue)"; content:"|0c|avp-scannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avp-sscaner.org (rogue)"; content:"|0b|avp-sscaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avp-sscannerr.org (rogue)"; content:"|0d|avp-sscannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplscaner-online.org (rogue)"; content:"|11|avplscaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplscanerr-online.org (rogue)"; content:"|12|avplscanerr-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplsscannerr.org (rogue)"; content:"|0d|avplsscannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplus-scanerr.org (rogue)"; content:"|0e|avplus-scanerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azzssdd935.com (malware)"; content:"|0a|azzssdd935|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bagmater.com (malware)"; content:"|08|bagmater|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannerxchg.org (malware)"; content:"|0a|bannerxchg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bc-wny.com (malware)"; content:"|06|bc-wny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bde-polytech.com (malware)"; content:"|0c|bde-polytech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beadarray.com (malware)"; content:"|09|beadarray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benlkans.com (malware)"; content:"|08|benlkans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benuoska.com (malware)"; content:"|08|benuoska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestviewbar.com (zeus)"; content:"|0b|bestviewbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibzopl.com (malware)"; content:"|07|bibzopl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup big-bucks.info (crimepack)"; content:"|09|big-bucks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigpayinfo.com (zeus)"; content:"|0a|bigpayinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogjoseartic.info (malware)"; content:"|0d|blogjoseartic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boardrevolutionmt2.com (malware)"; content:"|12|boardrevolutionmt2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobsvideohelp.com (malware)"; content:"|0d|bobsvideohelp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buyguardsoftware.com (fraud)"; content:"|10|buyguardsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup byp4k4t02010.xpg.com.br (malware)"; content:"|0c|byp4k4t02010|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cativelosepi.com.br (malware)"; content:"|0c|cativelosepi|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cerep.co.kr (malware)"; content:"|05|cerep|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chetiripolka.com (malware)"; content:"|0c|chetiripolka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckrczarna.pl (malware)"; content:"|09|ckrczarna|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnfg.maxsitesrevenues.net (malware)"; content:"|04|cnfg|10|maxsitesrevenues|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comeandie.in (zeus)"; content:"|09|comeandie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contexstyle.ru (malware)"; content:"|0b|contexstyle|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup convart.com (malware)"; content:"|07|convart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corfang.net (malware)"; content:"|07|corfang|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counte.org (malware)"; content:"|06|counte|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter-yandex.in (malware)"; content:"|0e|counter-yandex|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpadm21.cn (malware)"; content:"|07|cpadm21|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cralertyit.net (zeus)"; content:"|0a|cralertyit|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creatersanter.net (malware)"; content:"|0d|creatersanter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daejin-env.co.kr (malware)"; content:"|0a|daejin-env|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datacaretech.com (malware)"; content:"|0c|datacaretech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datamastertech.com (malware)"; content:"|0e|datamastertech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defashizmu.net (malware)"; content:"|0a|defashizmu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup definiteantispyware.com (Trojan )"; content:"|13|definiteantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dell-asecurity.com (malware)"; content:"|0e|dell-asecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dicoversciencenatural.com (rogue)"; content:"|15|dicoversciencenatural|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverallweapons.com (rogue)"; content:"|12|discoverallweapons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverebaymarket.com (rogue)"; content:"|12|discoverebaymarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverforexsecrets2.com (rogue)"; content:"|15|discoverforexsecrets2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discovermetallica.com (rogue)"; content:"|11|discovermetallica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoverneworder.com (rogue)"; content:"|10|discoverneworder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discoveryoursexuallity.com (rogue)"; content:"|16|discoveryoursexuallity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dog-sport.ayz.pl (malware)"; content:"|09|dog-sport|03|ayz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dossierpolitico.com (malware)"; content:"|0f|dossierpolitico|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dropschool.de (malware)"; content:"|0a|dropschool|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvddatacenter.com (malware)"; content:"|0d|dvddatacenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdmediahelp.com (malware)"; content:"|0c|dvdmediahelp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebay2secrets.com (rogue)"; content:"|0c|ebay2secrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edatingtipsandtricks.com (zeus)"; content:"|14|edatingtipsandtricks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emovieload.com (malware)"; content:"|0a|emovieload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup empcl.org (malware)"; content:"|05|empcl|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ero-para.jp (malware)"; content:"|08|ero-para|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eshopbr.com (malware)"; content:"|07|eshopbr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expertav-scaner-online.org (rogue)"; content:"|16|expertav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f1f1f.us (malware)"; content:"|05|f1f1f|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facallbook.com (malware)"; content:"|0a|facallbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-1st.com (malware)"; content:"|0c|facebook-1st|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-f.com (malware)"; content:"|0a|facebook-f|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-gurl.com (malware)"; content:"|0d|facebook-gurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-picz.info (malware)"; content:"|0d|facebook-picz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebookp.net (crimepack)"; content:"|09|facebookp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-payments.com (fraud)"; content:"|0d|fast-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastloadcom.com (malware)"; content:"|0b|fastloadcom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fest.snadder.org (malware)"; content:"|04|fest|07|snadder|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhjwhbvfthr.com (malware)"; content:"|0b|fhjwhbvfthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fleacebook.com (malware)"; content:"|0a|fleacebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flshgamer.info (malware)"; content:"|09|flshgamer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forum.hondaclubvysocina.cz (malware)"; content:"|05|forum|11|hondaclubvysocina|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeport-rotary.org (malware)"; content:"|0f|freeport-rotary|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fresh4.cc (malware)"; content:"|06|fresh4|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gabesflowers.co.cc (malware)"; content:"|0c|gabesflowers|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaddem.biz (malware)"; content:"|06|gaddem|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gavnoedov.net (zeus)"; content:"|09|gavnoedov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geoshield20.info (malware)"; content:"|0b|geoshield20|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get.send-photo.net (malware)"; content:"|03|get|0a|send-photo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gforhair.com (malware)"; content:"|08|gforhair|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gggirl.info (malware)"; content:"|06|gggirl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gohispanomedia.com (malware)"; content:"|0e|gohispanomedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gointernetdating.com (zeus)"; content:"|10|gointernetdating|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokl29ybs3.in (malware)"; content:"|0a|gokl29ybs3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmediainfo.com (malware)"; content:"|0d|goldmediainfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gooddatingadvice.net (zeus)"; content:"|10|gooddatingadvice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-aqalytics.info (rogue)"; content:"|10|google-aqalytics|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-nalytics.info (rogue)"; content:"|0f|google-nalytics|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlecomrad.com (malware)"; content:"|0c|googlecomrad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gothicmodel.org (malware)"; content:"|0b|gothicmodel|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grenadstop1.info (malware)"; content:"|0b|grenadstop1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardbilling.com (fraud)"; content:"|0c|guardbilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackercocuk.bplaced.net (malware)"; content:"|0b|hackercocuk|07|bplaced|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haggled.info (malware)"; content:"|07|haggled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-working.info (malware)"; content:"|0c|hard-working|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hd-win.com (malware)"; content:"|06|hd-win|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hipsterhandbook.com (malware)"; content:"|0f|hipsterhandbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hjelp-haiti.org (crimepack)"; content:"|0b|hjelp-haiti|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoodantispyware.com (Trojan )"; content:"|0f|hoodantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotdownloads.com (malware)"; content:"|0c|hotdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howtolisten.kr (malware)"; content:"|0b|howtolisten|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idpkorea.com (malware)"; content:"|08|idpkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ie-6-7-8-online-scan.org (Trojan )"; content:"|14|ie-6-7-8-online-scan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iefeiyusahgaineeveikooth.com (zeus)"; content:"|18|iefeiyusahgaineeveikooth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ikopec.com (malware)"; content:"|06|ikopec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imgdns.in (malware)"; content:"|06|imgdns|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info-defender.com (rogue)"; content:"|0d|info-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip.world1shop.com (crimepack)"; content:"|02|ip|0a|world1shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irc.superbits.net (malware)"; content:"|03|irc|09|superbits|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacksart.nl (malware)"; content:"|08|jacksart|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamaica.lv (malware)"; content:"|07|jamaica|02|lv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamesringrose.com (malware)"; content:"|0d|jamesringrose|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jast56kl.com (malware)"; content:"|08|jast56kl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jl.chura.pl (malware)"; content:"|02|jl|05|chura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup just-xc1le.de (malware)"; content:"|0a|just-xc1le|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kill-stupid-viruses.org (Trojan )"; content:"|13|kill-stupid-viruses|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kirda.in (malware)"; content:"|05|kirda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kodiak.power-heberg.com (malware)"; content:"|06|kodiak|0c|power-heberg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolpol3l.in (zeus)"; content:"|08|kolpol3l|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup la-cosa-nostra.biz (crimepack)"; content:"|0e|la-cosa-nostra|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakdamar.ro (malware)"; content:"|08|lakdamar|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lebouzou.fr (malware)"; content:"|08|lebouzou|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leedsconsult.net (malware)"; content:"|0c|leedsconsult|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likinto.com (malware)"; content:"|07|likinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lindenwoodinn.com (malware)"; content:"|0d|lindenwoodinn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loading-secure-scanner.org (Trojan )"; content:"|16|loading-secure-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup login.ipwhois.co.uk (crimepack)"; content:"|05|login|07|ipwhois|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup login.ipwhois.org.uk (crimepack)"; content:"|05|login|07|ipwhois|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logosnj.org (malware)"; content:"|07|logosnj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lolleskorp.com (malware)"; content:"|0a|lolleskorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luxor-groupinc.cc (moneymule)"; content:"|0e|luxor-groupinc|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m4st3r.info (malware)"; content:"|06|m4st3r|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghlyakmthr.com (malware)"; content:"|0b|mghlyakmthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movielocationinfo.com (malware)"; content:"|11|movielocationinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-iamge.com (malware)"; content:"|09|msn-iamge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzykologia.lublin.pl (malware)"; content:"|0b|muzykologia|06|lublin|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-computer-scanner-loading.org (Trojan )"; content:"|1b|my-computer-scanner-loading|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspace-com.net (malware)"; content:"|0b|myspace-com|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameservicehosting4.in (malware)"; content:"|13|nameservicehosting4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup napiwis54353.com (malware)"; content:"|0c|napiwis54353|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neosemitech.com (malware)"; content:"|0b|neosemitech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup net-own3r.com (malware)"; content:"|09|net-own3r|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsites2010.narod.ru (malware)"; content:"|0c|newsites2010|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nogame.datapimps.cn (crimepack)"; content:"|06|nogame|09|datapimps|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novellstars2.com (rogue)"; content:"|0c|novellstars2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novir121.in (malware)"; content:"|08|novir121|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odysseygrp.co.uk (malware)"; content:"|0a|odysseygrp|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scannerr.org (rogue)"; content:"|0f|online-scannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinemycomputersecure.org (Trojan )"; content:"|16|onlinemycomputersecure|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinescanerr.org (rogue)"; content:"|0d|onlinescanerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinescannerr.org (rogue)"; content:"|0e|onlinescannerr|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optimus-groupsvc.tw (moneymule)"; content:"|10|optimus-groupsvc|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup optimusgroupnet.cc (moneymule)"; content:"|0f|optimusgroupnet|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orgdnstest.in (malware)"; content:"|0a|orgdnstest|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p2700.pe.kr (malware)"; content:"|05|p2700|02|pe|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup personal-security-scanner.org (Trojan )"; content:"|19|personal-security-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ph0to-msn.com (malware)"; content:"|09|ph0to-msn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picdl.facebook-album.com (malware)"; content:"|05|picdl|0e|facebook-album|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pimages-f.com (malware)"; content:"|09|pimages-f|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinacle-demos.com (phish)"; content:"|0d|pinacle-demos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinacle-demos.net (phish)"; content:"|0d|pinacle-demos|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pldownloads.com (malware)"; content:"|0b|pldownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pnctreasury.com (phish)"; content:"|0b|pnctreasury|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pollo02.interfree.it (malware)"; content:"|07|pollo02|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacy-genie.com (rogue)"; content:"|0d|privacy-genie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protech.su (malware)"; content:"|07|protech|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectieantispyware.com (Trojan )"; content:"|14|protectieantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectpc-antispyware.com (Trojan )"; content:"|15|protectpc-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q-facebook.com (malware)"; content:"|0a|q-facebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q00qle.in (malware)"; content:"|06|q00qle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quicksetsystems.com (malware)"; content:"|0f|quicksetsystems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyxis.in (malware)"; content:"|05|qyxis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radioponpinshow.com (malware)"; content:"|0f|radioponpinshow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup railwaytraffic.com (malware)"; content:"|0e|railwaytraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retwite.com (malware)"; content:"|07|retwite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rizkymelvin.fileave.com (malware)"; content:"|0b|rizkymelvin|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robotipedia.com (malware)"; content:"|0b|robotipedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roguenet.info (crimepack)"; content:"|08|roguenet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romanticdateonline.com (zeus)"; content:"|12|romanticdateonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rthrwndda.bee.pl (malware)"; content:"|09|rthrwndda|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s4s8.com (malware)"; content:"|04|s4s8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samson.real-host.ru (malware)"; content:"|06|samson|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sasha12009.hostox.ru (malware)"; content:"|0a|sasha12009|06|hostox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityresearchers.com (malware)"; content:"|13|securityresearchers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sele.fileave.com (malware)"; content:"|04|sele|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup send-photo.net (malware)"; content:"|0a|send-photo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seozavrsss.com (malware)"; content:"|0a|seozavrsss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serial-key-serial.com (malware)"; content:"|11|serial-key-serial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serials-keys.com (malware)"; content:"|0c|serials-keys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexualwholeness.com (malware)"; content:"|0f|sexualwholeness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shelanet.com (malware)"; content:"|08|shelanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skkulove.com (malware)"; content:"|08|skkulove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skuffleinc.com (malware)"; content:"|0a|skuffleinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skydivefano.eu (malware)"; content:"|0b|skydivefano|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solid.go.ro (malware)"; content:"|05|solid|02|go|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparklygreeneyes.com (malware)"; content:"|10|sparklygreeneyes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedgore7.info (malware)"; content:"|0a|speedgore7|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedyav-scaner-online.org (rogue)"; content:"|16|speedyav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subarubestvideos.com (malware)"; content:"|10|subarubestvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup summitantispyware.com (Trojan )"; content:"|11|summitantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermegatube.net (malware)"; content:"|0d|supermegatube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superwin-2010.ru (malware)"; content:"|0d|superwin-2010|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suzuki02.fileave.com (malware)"; content:"|08|suzuki02|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys.telesweet.net (malware)"; content:"|03|sys|09|telesweet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taureaavant.com (malware)"; content:"|0b|taureaavant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxpark.com (malware)"; content:"|07|taxpark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup te.ync.ac.kr (malware)"; content:"|02|te|03|ync|02|ac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techcrunch.firm.in (malware)"; content:"|0a|techcrunch|04|firm|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tentor.ru (malware)"; content:"|06|tentor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebest-antispyware.com (Trojan )"; content:"|13|thebest-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theclubmovie.com (malware)"; content:"|0c|theclubmovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetubeclip.com (malware)"; content:"|0b|thetubeclip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thinkbuddies.de (malware)"; content:"|0c|thinkbuddies|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thriftyav-scaner-online.org (rogue)"; content:"|17|thriftyav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup timesav-scaner-online.org (rogue)"; content:"|15|timesav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafo-ix01.in (malware)"; content:"|0a|trafo-ix01|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafo-ix02.in (malware)"; content:"|0a|trafo-ix02|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafo-ix04.in (malware)"; content:"|0a|trafo-ix04|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafo-ix05.in (malware)"; content:"|0a|trafo-ix05|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup translatespanish.ru (malware)"; content:"|10|translatespanish|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trfafsegh.com (malware)"; content:"|09|trfafsegh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup user4.nameservicehosting4.in (malware)"; content:"|05|user4|13|nameservicehosting4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup users1.nofeehost.com (malware)"; content:"|06|users1|09|nofeehost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virdef.net (rogue)"; content:"|06|virdef|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virus-cleaner.net (rogue)"; content:"|0d|virus-cleaner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visualcrash19.info (malware)"; content:"|0d|visualcrash19|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vugg.net (malware)"; content:"|04|vugg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvbb.in (malware)"; content:"|04|vvbb|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wavi.in (malware)"; content:"|04|wavi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wearsarray.com (malware)"; content:"|0a|wearsarray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websporttracker.com (crimepack)"; content:"|0f|websporttracker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup well-6scanner.com (malware)"; content:"|0d|well-6scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wera1.co.tv (malware)"; content:"|05|wera1|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wera2.co.tv (malware)"; content:"|05|wera2|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wincrack.org (malware)"; content:"|08|wincrack|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-support.com (malware)"; content:"|0f|windows-support|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsmediadata.com (malware)"; content:"|10|windowsmediadata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wollance.com (malware)"; content:"|08|wollance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workzone46.info (malware)"; content:"|0a|workzone46|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldnetdirect.com (zeus)"; content:"|0e|worldnetdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup x-monitoring.com (zeus)"; content:"|0c|x-monitoring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xeonul.com (malware)"; content:"|06|xeonul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xyndet-shop.com (malware)"; content:"|0b|xyndet-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-updates.net (malware)"; content:"|0c|your-updates|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmultimediaload.com (malware)"; content:"|12|yourmultimediaload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zefferino.it (malware)"; content:"|09|zefferino|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zml-movie.com (malware)"; content:"|09|zml-movie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1003.trinityonline.biz (koobface)"; content:"|04|1003|0d|trinityonline|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1a-scanner.eu (rogue)"; content:"|0a|1a-scanner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1killspyware.eu (rogue)"; content:"|0c|1killspyware|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5killspyware.eu (rogue)"; content:"|0c|5killspyware|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6a-scanner.eu (rogue)"; content:"|0a|6a-scanner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7a-scanner.eu (rogue)"; content:"|0a|7a-scanner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 98341.com (malware)"; content:"|05|98341|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9a-scanner.eu (rogue)"; content:"|0a|9a-scanner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-ylukec.info (malware)"; content:"|08|a-ylukec|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aegisrealtyreo.com (koobface)"; content:"|0e|aegisrealtyreo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afrikchallenge.org (koobface)"; content:"|0e|afrikchallenge|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ailg-riad.org (backdoor)"; content:"|09|ailg-riad|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajijpqhathr.com (malware)"; content:"|0b|ajijpqhathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akakalat.com (russkill)"; content:"|08|akakalat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alafoto.se (koobface)"; content:"|07|alafoto|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alankaye.info (koobface)"; content:"|08|alankaye|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alkhoei.org (koobface)"; content:"|07|alkhoei|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amazingpets.org (koobface)"; content:"|0b|amazingpets|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amicegypt.com (koobface)"; content:"|09|amicegypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amtechstl.com (koobface)"; content:"|09|amtechstl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anazaragoza.es (backdoor)"; content:"|0b|anazaragoza|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup animalsitting.be (koobface)"; content:"|0d|animalsitting|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anlaegkp.dk (koobface)"; content:"|08|anlaegkp|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anna-mag.com (malware)"; content:"|08|anna-mag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarerar.com (malware)"; content:"|0e|antispywarerar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivvirrus.com (malware)"; content:"|0b|antivvirrus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquababy.dk (koobface)"; content:"|08|aquababy|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aspensupersite.ru (fastflux)"; content:"|0e|aspensupersite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autograd.com.ua (koobface)"; content:"|08|autograd|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awatch4u2.com (koobface)"; content:"|09|awatch4u2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basecampprerov.cz (koobface)"; content:"|0e|basecampprerov|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup battlegroundbaseball.com (koobface)"; content:"|14|battlegroundbaseball|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup becker.webd.pl (koobface)"; content:"|06|becker|04|webd|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beiseelers.de (koobface)"; content:"|0a|beiseelers|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bighornrivercabins.com (koobface)"; content:"|12|bighornrivercabins|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billig-bauer.de (koobface)"; content:"|0c|billig-bauer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blendermagazineonline.ru (fastflux)"; content:"|15|blendermagazineonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bloomfieldlivestockmarket.com (koobface)"; content:"|19|bloomfieldlivestockmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluezone.co.il (koobface)"; content:"|08|bluezone|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blushweddingday.com (koobface)"; content:"|0f|blushweddingday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonniejohns.myiadt.net (malware)"; content:"|0b|bonniejohns|06|myiadt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brentsmusic.com (koobface)"; content:"|0b|brentsmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightonrooms.co.uk (koobface)"; content:"|0d|brightonrooms|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brkweb.net (koobface)"; content:"|06|brkweb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brusselslivestock.ca (koobface)"; content:"|11|brusselslivestock|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burtonsvillelocksmith.net (koobface)"; content:"|15|burtonsvillelocksmith|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bushdecor.com (koobface)"; content:"|09|bushdecor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup captrend.com (malware)"; content:"|08|captrend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup car-transport.com.au (koobface)"; content:"|0d|car-transport|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carlosarcos.com (backdoor)"; content:"|0b|carlosarcos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carolslinks.com (koobface)"; content:"|0b|carolslinks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbgstudents.com (koobface)"; content:"|0b|cbgstudents|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cccforum.be (koobface)"; content:"|08|cccforum|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cefila.com (trojan)"; content:"|06|cefila|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceipdoctorseres.org (koobface)"; content:"|0f|ceipdoctorseres|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebrem.com (koobface)"; content:"|08|celebrem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrislobue.com (koobface)"; content:"|0a|chrislobue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckmbc.com (koobface)"; content:"|05|ckmbc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnsa56.info (exploit)"; content:"|06|cnsa56|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comnetstudio.com (koobface)"; content:"|0c|comnetstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup condenast.tempwebpage.com (koobface)"; content:"|09|condenast|0b|tempwebpage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooperville.be (koobface)"; content:"|0b|cooperville|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corteostoricoterrasanctibenedicti.org (koobface)"; content:"|21|corteostoricoterrasanctibenedicti|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counterbest.ru (fastflux)"; content:"|0b|counterbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cubman32.net.ua (koobface)"; content:"|08|cubman32|03|net|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curveswithlove.com.au (koobface)"; content:"|0e|curveswithlove|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d55voypa5v.win.aplus.net (koobface)"; content:"|0a|d55voypa5v|03|win|05|aplus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbtravelworld.com (koobface)"; content:"|0d|dbtravelworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deadlyserious.co.uk (koobface)"; content:"|0d|deadlyserious|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deaf-world-gehoerlos-friend.de (koobface)"; content:"|1b|deaf-world-gehoerlos-friend|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decolff.be (koobface)"; content:"|07|decolff|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deltasatuk.com (koobface)"; content:"|0a|deltasatuk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demozonecentral.at (fastflux)"; content:"|0f|demozonecentral|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dinovincenzopatroni.com (koobface)"; content:"|13|dinovincenzopatroni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup districtdender.getconnected.be (koobface)"; content:"|0e|districtdender|0c|getconnected|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dllnk.in (Trojan )"; content:"|05|dllnk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnfpg.net (malware)"; content:"|05|dnfpg|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dogfoog.net (malware)"; content:"|07|dogfoog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donnatravel.kiev.ua (koobface)"; content:"|0b|donnatravel|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.rmes.ru (koobface)"; content:"|08|download|04|rmes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dricmc.com (koobface)"; content:"|06|dricmc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drive-class.ru (koobface)"; content:"|0b|drive-class|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drive4marten.com (koobface)"; content:"|0c|drive4marten|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dusinklubben.dk (koobface)"; content:"|0c|dusinklubben|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvstyl.cz (koobface)"; content:"|06|dvstyl|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecole-de-boucq.org (koobface)"; content:"|0e|ecole-de-boucq|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edensensuel.fr (koobface)"; content:"|0b|edensensuel|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup efficientenergysystems.ca (koobface)"; content:"|16|efficientenergysystems|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epbh.org (koobface)"; content:"|04|epbh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertrafikskola.se (koobface)"; content:"|0d|ertrafikskola|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esextherapy.com (koobface)"; content:"|0b|esextherapy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurasiamotor.com (backdoor)"; content:"|0c|eurasiamotor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurobizlink.com (koobface)"; content:"|0b|eurobizlink|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup experiencercsm.com (koobface)"; content:"|0e|experiencercsm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ez.jrlearning.com (Backdoor)"; content:"|02|ez|0a|jrlearning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairfaxlocksmith.com (koobface)"; content:"|10|fairfaxlocksmith|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fan.filipinaprincess.com (koobface)"; content:"|03|fan|10|filipinaprincess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feuerwehr-zermatt.ch (koobface)"; content:"|11|feuerwehr-zermatt|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiarn.com (koobface)"; content:"|05|fiarn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financialnewsanalyst.com (koobface)"; content:"|14|financialnewsanalyst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fininve.it (koobface)"; content:"|07|fininve|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firstimpressionsstaging.net (koobface)"; content:"|17|firstimpressionsstaging|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forgrigoriy.balandin.ru (koobface)"; content:"|0b|forgrigoriy|08|balandin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formacio.eio.es (koobface)"; content:"|08|formacio|03|eio|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fredericia-stavgang.dk (koobface)"; content:"|13|fredericia-stavgang|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genesisforums.net (koobface)"; content:"|0d|genesisforums|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genesiskdmparts.com (koobface)"; content:"|0f|genesiskdmparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginun-oz.co.il (koobface)"; content:"|08|ginun-oz|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gostehstroy.ru (koobface)"; content:"|0b|gostehstroy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsa.info (malware)"; content:"|07|gowinsa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsb.info (malware)"; content:"|07|gowinsb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsc.info (neosploit)"; content:"|07|gowinsc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsd.info (malware)"; content:"|07|gowinsd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinse.info (malware)"; content:"|07|gowinse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsf.info (neosploit)"; content:"|07|gowinsf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsg.info (malware)"; content:"|07|gowinsg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsh.info (malware)"; content:"|07|gowinsh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsj.info (neosploit)"; content:"|07|gowinsj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gowinsq.info (malware)"; content:"|07|gowinsq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grdcb.com (koobface)"; content:"|05|grdcb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gvpschekschov.iv-edu.ru (koobface)"; content:"|0d|gvpschekschov|06|iv-edu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzxguan.com (Exploits )"; content:"|07|gzxguan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hadsund-jagt.dk (koobface)"; content:"|0c|hadsund-jagt|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haggards.de (koobface)"; content:"|08|haggards|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hanackeskanzen.cz (koobface)"; content:"|0e|hanackeskanzen|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hate.filipinaprincess.com (koobface)"; content:"|04|hate|10|filipinaprincess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helphomecare.at (fastflux)"; content:"|0c|helphomecare|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hightiderentals.com (koobface)"; content:"|0f|hightiderentals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitechsolutioncenter.com (koobface)"; content:"|14|hitechsolutioncenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idif.it (koobface)"; content:"|04|idif|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indiawildlifetourpackages.com (koobface)"; content:"|19|indiawildlifetourpackages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup informatique86.fr (koobface)"; content:"|0e|informatique86|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intelsourcepvt.com (koobface)"; content:"|0e|intelsourcepvt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetcityhosting.com (koobface)"; content:"|13|internetcityhosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipera.it (koobface)"; content:"|05|ipera|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivanushko.dp.ua (koobface)"; content:"|09|ivanushko|02|dp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcshop.netfirms.com (koobface)"; content:"|06|jcshop|08|netfirms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jenniferjonesphotos.com (koobface)"; content:"|13|jenniferjonesphotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jh-shop.com (koobface)"; content:"|07|jh-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup journalsexyplus.com (koobface)"; content:"|0f|journalsexyplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jungersen.net (koobface)"; content:"|09|jungersen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jwdtrees.com (koobface)"; content:"|08|jwdtrees|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalender.sttmedia.se (koobface)"; content:"|08|kalender|08|sttmedia|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaleto.com.ar (backdoor)"; content:"|06|kaleto|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karweitjes.santele.be (koobface)"; content:"|0a|karweitjes|07|santele|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcresale.com (koobface)"; content:"|08|kcresale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kennethom.net (koobface)"; content:"|09|kennethom|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kip-rogers.com (threat)"; content:"|0a|kip-rogers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kk.gasasqww.com (malware)"; content:"|02|kk|08|gasasqww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krocketklubben1972.dk (koobface)"; content:"|12|krocketklubben1972|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lavalledellupo.it (koobface)"; content:"|0e|lavalledellupo|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likkewaan.co.za (koobface)"; content:"|09|likkewaan|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lilianverhaegen.be (koobface)"; content:"|0f|lilianverhaegen|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lionkitchen.com.sg (koobface)"; content:"|0b|lionkitchen|03|com|02|sg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup littlepalmbeach.com (koobface)"; content:"|0f|littlepalmbeach|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadtube.ru (fastflux)"; content:"|08|loadtube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locator.getconnected.be (koobface)"; content:"|07|locator|0c|getconnected|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lockportwrestling.com (koobface)"; content:"|11|lockportwrestling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lwcclax.com (koobface)"; content:"|07|lwcclax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macom.co.at (koobface)"; content:"|05|macom|02|co|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magnaniwines.com (koobface)"; content:"|0c|magnaniwines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martin-acke.be (koobface)"; content:"|0b|martin-acke|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdcoc.net (koobface)"; content:"|05|mdcoc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediast.eu (koobface)"; content:"|07|mediast|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micaelmarkstrom.se (koobface)"; content:"|0f|micaelmarkstrom|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobirayz.com (koobface)"; content:"|08|mobirayz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momentsbypat.com (koobface)"; content:"|0c|momentsbypat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motionmediadesign.net (koobface)"; content:"|11|motionmediadesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvccpa.org (koobface)"; content:"|06|mvccpa|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mx2.jellingnet.dk (koobface)"; content:"|03|mx2|0a|jellingnet|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myartcomunication.com (koobface)"; content:"|11|myartcomunication|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbcf.co.uk (koobface)"; content:"|04|nbcf|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvranch-alpacas.com (koobface)"; content:"|0f|nvranch-alpacas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oceanacompany.com (koobface)"; content:"|0d|oceanacompany|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omninatura.com (backdoor)"; content:"|0a|omninatura|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orangery.nezhin.com (koobface)"; content:"|08|orangery|06|nezhin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup palmaleinehof.be (koobface)"; content:"|0d|palmaleinehof|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pangea-consulting.com (koobface)"; content:"|11|pangea-consulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peacockalleyantiques.com (koobface)"; content:"|14|peacockalleyantiques|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photo-reviews.com (koobface)"; content:"|0d|photo-reviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phytogamme.com (koobface)"; content:"|0a|phytogamme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pjnyfd.com (koobface)"; content:"|06|pjnyfd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poll.santele.be (koobface)"; content:"|04|poll|07|santele|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup preventthebite.com (koobface)"; content:"|0e|preventthebite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup proelec-dpt.fr (koobface)"; content:"|0b|proelec-dpt|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promotion.cashdailygroup.com (koobface)"; content:"|09|promotion|0e|cashdailygroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qiautobrokers.com (koobface)"; content:"|0d|qiautobrokers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qualityrecords.com.au (koobface)"; content:"|0e|qualityrecords|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rabadanmakeupartist.com (koobface)"; content:"|13|rabadanmakeupartist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rentsatoday.com (koobface)"; content:"|0b|rentsatoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup restaurant-premier.com (koobface)"; content:"|12|restaurant-premier|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reusp.com (koobface)"; content:"|05|reusp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rgrealty.net (koobface)"; content:"|08|rgrealty|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ristorantecaminetto.it (koobface)"; content:"|13|ristorantecaminetto|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rksrouby.cz (koobface)"; content:"|08|rksrouby|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtrans.spb.ru (koobface)"; content:"|06|rtrans|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s1021009.crystone.net (koobface)"; content:"|08|s1021009|08|crystone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s198814458.onlinehome.us (koobface)"; content:"|0a|s198814458|0a|onlinehome|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sa-vand.dk (koobface)"; content:"|07|sa-vand|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salihyilmaz.org (koobface)"; content:"|0b|salihyilmaz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup schaffer.us (koobface)"; content:"|08|schaffer|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seagoldonline.ru (fastflux)"; content:"|0d|seagoldonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seapearl.info (koobface)"; content:"|08|seapearl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sesco.nl (koobface)"; content:"|05|sesco|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexynubile.femdomtoon.com (koobface)"; content:"|0a|sexynubile|0a|femdomtoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shannondreamlabradors.de (koobface)"; content:"|15|shannondreamlabradors|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirleymancino.com (koobface)"; content:"|0e|shirleymancino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shogunlevallois.com (koobface)"; content:"|0f|shogunlevallois|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silverbirdgroup.com (koobface)"; content:"|0f|silverbirdgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup singlepalm.com (koobface)"; content:"|0a|singlepalm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinonilimited.com (koobface)"; content:"|0d|sinonilimited|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skylergreene.com (koobface)"; content:"|0c|skylergreene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soniascreations.com.au (koobface)"; content:"|0f|soniascreations|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundcity.typo3hosting.ch (koobface)"; content:"|09|soundcity|0c|typo3hosting|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spain.gratishost.com (koobface)"; content:"|05|spain|0a|gratishost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sphusa.com (koobface)"; content:"|06|sphusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportmeeuwengruitrode.be (koobface)"; content:"|15|sportmeeuwengruitrode|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-urru.703.com1.ru (koobface)"; content:"|0a|stats-urru|03|703|04|com1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stevenslargetreesales.com (koobface)"; content:"|15|stevenslargetreesales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stgsfw7sr.com (fastflux)"; content:"|09|stgsfw7sr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopreporter.com (koobface)"; content:"|0c|stopreporter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sttmedia.se (koobface)"; content:"|08|sttmedia|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuartthomasmanor.com (koobface)"; content:"|11|stuartthomasmanor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svensmits.be (koobface)"; content:"|09|svensmits|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweetsitetools.ru (fastflux)"; content:"|0e|sweetsitetools|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup symposium.israimplant.com (koobface)"; content:"|09|symposium|0b|israimplant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tehnocentr.chita.ru (koobface)"; content:"|0a|tehnocentr|05|chita|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telework.tutmozis.com (koobface)"; content:"|08|telework|08|tutmozis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ternkeyrentals.com (koobface)"; content:"|0e|ternkeyrentals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testing.onlinesigns.co.za (koobface)"; content:"|07|testing|0b|onlinesigns|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thedarkorder.info (fastflux)"; content:"|0c|thedarkorder|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themarketingroomonline.com (koobface)"; content:"|16|themarketingroomonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themeadowsfamily.com (koobface)"; content:"|10|themeadowsfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestocksite.ru (fastflux)"; content:"|0c|thestocksite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup threadsneedlepoint.com (koobface)"; content:"|12|threadsneedlepoint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tompkinssolutions.netfirms.com (koobface)"; content:"|11|tompkinssolutions|08|netfirms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toverhanden.getconnected.be (koobface)"; content:"|0b|toverhanden|0c|getconnected|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tp-sobesednik.com (koobface)"; content:"|0d|tp-sobesednik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trabajar.org.ar (koobface)"; content:"|08|trabajar|03|org|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trattoriabilly.com (koobface)"; content:"|0e|trattoriabilly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup travelsek.com (koobface)"; content:"|09|travelsek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuscanyresidenceclub.com (koobface)"; content:"|14|tuscanyresidenceclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubetwireless.com (koobface)"; content:"|0c|ubetwireless|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uitgehuild.nl (koobface)"; content:"|0a|uitgehuild|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usadance-royalpalm.org (koobface)"; content:"|12|usadance-royalpalm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vabk.org (koobface)"; content:"|04|vabk|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoleverage.com (koobface)"; content:"|0d|videoleverage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vivatap-usa.com (koobface)"; content:"|0b|vivatap-usa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkjk6.info (malware)"; content:"|05|vkjk6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vp-listings.com (koobface)"; content:"|0b|vp-listings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyznamovyslovnik.cz (koobface)"; content:"|10|vyznamovyslovnik|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waypoint-center.org (koobface)"; content:"|0f|waypoint-center|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wibworld.com (koobface)"; content:"|08|wibworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workmantech.net (koobface)"; content:"|0b|workmantech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wttcmi.com (koobface)"; content:"|06|wttcmi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yarentextil.com (koobface)"; content:"|0b|yarentextil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yorkcountycba.com (koobface)"; content:"|0d|yorkcountycba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yurafting.com (koobface)"; content:"|09|yurafting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziasgelato.com (koobface)"; content:"|0a|ziasgelato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsrr.sileman.net.pl (koobface)"; content:"|04|zsrr|07|sileman|03|net|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0n0.in (malware)"; content:"|03|0n0|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2pstudio.pl (malware)"; content:"|08|2pstudio|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 360350.cn (malware)"; content:"|06|360350|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 51etu.com (malware)"; content:"|05|51etu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 76718426.info (malware)"; content:"|08|76718426|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9istyle.com (malicious)"; content:"|07|9istyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aadamsart.com (rogue)"; content:"|09|aadamsart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdhmegathr.com (malicious)"; content:"|0b|acdhmegathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdrrtqathr.com (malicious)"; content:"|0b|acdrrtqathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ada4.net (trojan)"; content:"|04|ada4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agreement52.com (malware)"; content:"|0b|agreement52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahjcwkbathr.com (malicious)"; content:"|0b|ahjcwkbathr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahoh.in (malware)"; content:"|04|ahoh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akilanews.com (malicious)"; content:"|09|akilanews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amd-fusion.com (Exploits )"; content:"|0a|amd-fusion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amdfusion.com (Exploits )"; content:"|09|amdfusion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amju.com (rogue)"; content:"|04|amju|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andrewstoltz.com (Exploits )"; content:"|0c|andrewstoltz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aniashok.com (rogue)"; content:"|08|aniashok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup araturka.org (virus)"; content:"|08|araturka|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ardamax.com (malware)"; content:"|07|ardamax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availablemultimedia.com (virus)"; content:"|13|availablemultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayzfsewtqvfa.com (malicious)"; content:"|0c|ayzfsewtqvfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azularc.com (Exploits )"; content:"|07|azularc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup behindthescenesmarketing.com (rogue)"; content:"|18|behindthescenesmarketing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billywhitemusic.com (rogue)"; content:"|0f|billywhitemusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bognorbadmintonclub.org.uk (rogue)"; content:"|13|bognorbadmintonclub|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boluoniu.su (malicious)"; content:"|08|boluoniu|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup box-mag.com (rogue)"; content:"|07|box-mag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandnuvision.com (virus)"; content:"|0d|brandnuvision|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calicutinternationalschool.com (malicious)"; content:"|1a|calicutinternationalschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canoeflorida.com (rogue)"; content:"|0c|canoeflorida|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralboilerservice.com (rogue)"; content:"|14|centralboilerservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherokeepainting.com (Exploits )"; content:"|10|cherokeepainting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup christianandpaula.com (Exploits )"; content:"|11|christianandpaula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click-clicke.com (fastflux)"; content:"|0c|click-clicke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectanalyst.com (fastflux)"; content:"|0e|connectanalyst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contiproductions.com (Exploits )"; content:"|10|contiproductions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolblender.ru (malware)"; content:"|0b|coolblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corosannicola.org (virus)"; content:"|0d|corosannicola|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crimeismine.org (malicious)"; content:"|0b|crimeismine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cspmedical.com (malware)"; content:"|0a|cspmedical|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dakistech.com (rogue)"; content:"|09|dakistech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dccpa.us (rogue)"; content:"|05|dccpa|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designstage.net (rogue)"; content:"|0b|designstage|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup distantmind.org (rogue)"; content:"|0b|distantmind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dle-ke17.net (fastflux)"; content:"|08|dle-ke17|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlle-vmb17.com (fastflux)"; content:"|0a|dlle-vmb17|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domainsupp.net (fastflux)"; content:"|0a|domainsupp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.boxoffice.com.ua (Exploits )"; content:"|08|download|09|boxoffice|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drsaliterman.com (rogue)"; content:"|0c|drsaliterman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e9j.net (malware)"; content:"|03|e9j|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddpiii.com.pl (crimeware)"; content:"|07|eddpiii|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddsiii.com.pl (crimeware)"; content:"|07|eddsiii|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddsiip.com.pl (crimeware)"; content:"|07|eddsiip|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddsiui.com.pl (crimeware)"; content:"|07|eddsiui|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddsiuo.com.pl (crimeware)"; content:"|07|eddsiuo|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eddsiuy.com.pl (crimeware)"; content:"|07|eddsiuy|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edduiip.com.pl (crimeware)"; content:"|07|edduiip|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edduiiz.com.pl (crimeware)"; content:"|07|edduiiz|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edduyiz.com.pl (crimeware)"; content:"|07|edduyiz|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edouyiz.com.pl (crimeware)"; content:"|07|edouyiz|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekouyiz.com.pl (crimeware)"; content:"|07|ekouyiz|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elevendistant.com (rogue)"; content:"|0d|elevendistant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emhand.com (gumblar)"; content:"|06|emhand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erm-energy-ops.com (rogue)"; content:"|0e|erm-energy-ops|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estero89.ru (fastflux)"; content:"|08|estero89|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eventwerk24.de (virus)"; content:"|0b|eventwerk24|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fcuked.me.uk (malware)"; content:"|06|fcuked|02|me|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fdgdfgii.com (risk)"; content:"|08|fdgdfgii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fishmaldives.com (rogue)"; content:"|0c|fishmaldives|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashsrealm.com (rogue)"; content:"|0b|flashsrealm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flohr.tuknet.dk (malware)"; content:"|05|flohr|06|tuknet|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup focalpointfoto.com (rogue)"; content:"|0e|focalpointfoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forskarskolan.se (malicious)"; content:"|0d|forskarskolan|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freddiepicks.com (rogue)"; content:"|0c|freddiepicks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geekymom.com (rogue)"; content:"|08|geekymom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gghgijfgthr.com (harmful)"; content:"|0b|gghgijfgthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gohoot.com (rogue)"; content:"|06|gohoot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hallcash.net (fastflux)"; content:"|08|hallcash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hamsi.be (malware)"; content:"|05|hamsi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happycamperhaven.com (rogue)"; content:"|10|happycamperhaven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hard-headed.info (malicious)"; content:"|0b|hard-headed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup healingcreative.com (rogue)"; content:"|0f|healingcreative|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hideyhole.org (malware)"; content:"|09|hideyhole|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hlstudiophoto.com (rogue)"; content:"|0d|hlstudiophoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house2homeinspections.biz (rogue)"; content:"|15|house2homeinspections|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hpslo.com (malware)"; content:"|05|hpslo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hunt4home.co.uk (virus)"; content:"|09|hunt4home|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hutererere.com (malware)"; content:"|0a|hutererere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iching-science.com (virus)"; content:"|0e|iching-science|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ileyoeyqyesm.info (malicious)"; content:"|0c|ileyoeyqyesm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itkornoval.in (malicious)"; content:"|0a|itkornoval|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jedwabnytarg.pl (virus)"; content:"|0c|jedwabnytarg|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjfrancis.com (rogue)"; content:"|09|jjfrancis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jmqzgublzxg.com (malicious)"; content:"|0b|jmqzgublzxg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kioscomayor.com (virus)"; content:"|0b|kioscomayor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labroderiedemouna.com (malware)"; content:"|11|labroderiedemouna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landoftraffic.in (malicious)"; content:"|0d|landoftraffic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lauriello.lunarpages.com (rogue)"; content:"|09|lauriello|0a|lunarpages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lockwasherdesign.com (rogue)"; content:"|10|lockwasherdesign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longtermrelations.com (fastflux)"; content:"|11|longtermrelations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotr.in (risk)"; content:"|04|lotr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lsrmg.com (Exploits )"; content:"|05|lsrmg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lxfserryfrjr.com (malicious)"; content:"|0c|lxfserryfrjr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lynnmariedesigns.com (rogue)"; content:"|10|lynnmariedesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzqaaxtzftpl.com (malicious)"; content:"|0c|lzqaaxtzftpl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madnesscoaching.org (rogue)"; content:"|0f|madnesscoaching|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mak06.com (virus)"; content:"|05|mak06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamama.aa.am (malware)"; content:"|06|mamama|02|aa|02|am"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maps-online.org (rogue)"; content:"|0b|maps-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mattandmelissaberg.com (rogue)"; content:"|12|mattandmelissaberg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membranassh.biz (fastflux)"; content:"|0b|membranassh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memories-in-thread.net (rogue)"; content:"|12|memories-in-thread|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mhergert.com (rogue)"; content:"|08|mhergert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup michaelweglinski.com (rogue)"; content:"|10|michaelweglinski|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millages.net (malicious)"; content:"|08|millages|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mivdo.in (exploit)"; content:"|05|mivdo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjsgsawz.com (malware)"; content:"|08|mjsgsawz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmjl3l45lkjbdb.ru (fastflux)"; content:"|0e|mmjl3l45lkjbdb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup molbquhwebp.info (malicious)"; content:"|0b|molbquhwebp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morroart.com (Exploits )"; content:"|08|morroart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup most4wheels.com (virus)"; content:"|0b|most4wheels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muellersfuneralhomes.com (virus)"; content:"|14|muellersfuneralhomes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murk.in (malware)"; content:"|04|murk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mustangviper.com (virus)"; content:"|0c|mustangviper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my.me-1.info (malware)"; content:"|02|my|04|me-1|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myblackmarket.org (Exploits )"; content:"|0d|myblackmarket|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbcgibfnthr.com (neosploit)"; content:"|0b|nbcgibfnthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nermdusa.com (malware)"; content:"|08|nermdusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkads.net (virus)"; content:"|0a|networkads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newantispyware.com (malware)"; content:"|0e|newantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextquestion.org (rogue)"; content:"|0c|nextquestion|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhb-64.net (malware)"; content:"|06|nhb-64|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nila1.fileave.com (virus)"; content:"|05|nila1|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niopler.com (exploit)"; content:"|07|niopler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nwzonline.de (virus)"; content:"|09|nwzonline|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nzhvrurtym.com (malicious)"; content:"|0a|nzhvrurtym|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldimya.com (malware)"; content:"|07|oldimya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oliakoimds67.jino.ru (virus)"; content:"|0c|oliakoimds67|04|jino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omingor.com (threat)"; content:"|07|omingor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinewebfiles.biz (malware)"; content:"|0e|onlinewebfiles|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osloebi.com (malware)"; content:"|07|osloebi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otanri.com (virus)"; content:"|06|otanri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otddelivery.com (rogue)"; content:"|0b|otddelivery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pampkinshet-oit.com (fastflux)"; content:"|0f|pampkinshet-oit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parcolaghidelfarfa.net (malware)"; content:"|12|parcolaghidelfarfa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parsonel.com (malicious)"; content:"|08|parsonel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pathontechnologies.com (rogue)"; content:"|12|pathontechnologies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbbbckfe.cn (malware)"; content:"|08|pbbbckfe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plincx.com (malware)"; content:"|06|plincx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porncenter.tk (malware)"; content:"|0a|porncenter|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pozemk.com (malware)"; content:"|06|pozemk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqeglybdus.co.cc (threat)"; content:"|0a|pqeglybdus|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projectconsultingspecialists.com (rogue)"; content:"|1c|projectconsultingspecialists|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghqodpqthr.com (threat)"; content:"|0b|qghqodpqthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qhpitrszbg.co.cc (malware)"; content:"|0a|qhpitrszbg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raceworldpeople.com (malware)"; content:"|0f|raceworldpeople|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rajkotchamber.com (malware)"; content:"|0d|rajkotchamber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramadan.com.au (malware)"; content:"|07|ramadan|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramstor.in (threat)"; content:"|07|ramstor|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapesleed.in (fastflux)"; content:"|09|rapesleed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resellershops.com (Exploits )"; content:"|0d|resellershops|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rinconmineral.com (rogue)"; content:"|0d|rinconmineral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronsk.co.cc (exploit)"; content:"|05|ronsk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs922eun.rapidshare.com (malware)"; content:"|08|rs922eun|0a|rapidshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup segurancaprivativa.com.br (malware)"; content:"|12|segurancaprivativa|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selectgold.com (rogue)"; content:"|0a|selectgold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senbhiyropp.com (threat)"; content:"|0b|senbhiyropp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sgecon.org (rogue)"; content:"|06|sgecon|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sggperu.org (virus)"; content:"|07|sggperu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shankbonemystic.com (rogue)"; content:"|0f|shankbonemystic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slowauto.com (malware)"; content:"|08|slowauto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smilson.com (rogue)"; content:"|07|smilson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smskb.com (malware)"; content:"|05|smskb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sobakozgav.net (malware)"; content:"|0a|sobakozgav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup songseungheon.com (malicious)"; content:"|0d|songseungheon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splspl140.in (fastflux)"; content:"|09|splspl140|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup srvfileidftp10.com (fastflux)"; content:"|0e|srvfileidftp10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stashbox.org (virus)"; content:"|08|stashbox|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermen.web44.net (malware)"; content:"|08|supermen|05|web44|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superxxxclip.info (virus)"; content:"|0c|superxxxclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talon-systems.com (rogue)"; content:"|0d|talon-systems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teendoos.com (virus)"; content:"|08|teendoos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tetegagatete-te.com (fastflux)"; content:"|0f|tetegagatete-te|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teyda.in (fastflux)"; content:"|05|teyda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theboehringers.com (rogue)"; content:"|0e|theboehringers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelionkingmind.com (rogue)"; content:"|0f|thelionkingmind|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup therealnews.com (virus)"; content:"|0b|therealnews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thereismypuper-gb.com (fastflux)"; content:"|11|thereismypuper-gb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thereismysuper-d.com (fastflux)"; content:"|10|thereismysuper-d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thuanantp.com.vn (malware)"; content:"|09|thuanantp|03|com|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tier33.info (malware)"; content:"|06|tier33|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup titill.com (malware)"; content:"|06|titill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tjsokolosek.wz.cz (malware)"; content:"|0b|tjsokolosek|02|wz|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tomsmassagepraxis.at (malware)"; content:"|11|tomsmassagepraxis|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trenz.pl (malware)"; content:"|05|trenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tttaaattt.ru (malware)"; content:"|09|tttaaattt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typofelts.com (virus)"; content:"|09|typofelts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unruly1.com (rogue)"; content:"|07|unruly1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urban-smile.com (rogue)"; content:"|0b|urban-smile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usapersonaltraining.com (rogue)"; content:"|13|usapersonaltraining|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valleyent.net (malware)"; content:"|09|valleyent|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vcp-counter.com (malware)"; content:"|0b|vcp-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vernonmusic.com (rogue)"; content:"|0b|vernonmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vijgeboom.com (rogue)"; content:"|09|vijgeboom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vitbdxcsflr.com (malicious)"; content:"|0b|vitbdxcsflr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvas.in (malware)"; content:"|04|vvas|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvsen.in (malware)"; content:"|05|vvsen|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxoyqgcp.cn (malware)"; content:"|08|vxoyqgcp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wanderingwolves.com (malware)"; content:"|0f|wanderingwolves|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wegus.shacknet.nu (virus)"; content:"|05|wegus|08|shacknet|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wendycass.net (rogue)"; content:"|09|wendycass|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whichhue.com.au (rogue)"; content:"|08|whichhue|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-defender-shop-software.com (malware)"; content:"|1e|windows-defender-shop-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windsorbreads.com (rogue)"; content:"|0d|windsorbreads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wordwacker.com (rogue)"; content:"|0a|wordwacker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldofporno.info (virus)"; content:"|0c|worldofporno|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvvvw-quicktime.com (fraud)"; content:"|0f|wvvvw-quicktime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwjdgoon.co.cc (fastflux)"; content:"|08|wwjdgoon|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xingno.com (backdoor)"; content:"|06|xingno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxzzz.free319.info (malware)"; content:"|06|xxxzzz|07|free319|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xzonesports.com (rogue)"; content:"|0b|xzonesports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourpartygirls.net (rogue)"; content:"|0e|yourpartygirls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zehonte.com (virus)"; content:"|07|zehonte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zzlzx.com (malware)"; content:"|05|zzlzx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12sp.co.tv (malware)"; content:"|04|12sp|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1site.us (malware)"; content:"|05|1site|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2a-scanner.eu (rogue)"; content:"|0a|2a-scanner|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3killspyware.eu (rogue)"; content:"|0c|3killspyware|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4m70.in (malware)"; content:"|04|4m70|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abandonemicrosoft.net (hacktool)"; content:"|11|abandonemicrosoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abk.bee.pl (trojan )"; content:"|03|abk|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adanaocakbasi.com (threat)"; content:"|0d|adanaocakbasi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aenature.com (malware)"; content:"|08|aenature|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aha.bij.pl (malware)"; content:"|03|aha|03|bij|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ahjhedu.com (malware)"; content:"|07|ahjhedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aleksgood.real-host.ru (malware)"; content:"|09|aleksgood|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfive.dk (backdoor)"; content:"|07|allfive|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amateure-redtube.com (backdoor)"; content:"|10|amateure-redtube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup americinn.com (malware)"; content:"|09|americinn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asswar.us (malware)"; content:"|06|asswar|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baanpetitesirene.com (malware)"; content:"|10|baanpetitesirene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baccara.im (trojan )"; content:"|07|baccara|02|im"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bannnas.com (malware)"; content:"|07|bannnas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bargainfloralarts.com (rogue)"; content:"|11|bargainfloralarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellville.gov.ar (worm_bagle)"; content:"|09|bellville|03|gov|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfloralarts.com (rogue)"; content:"|0e|bestfloralarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsocksshop.ru (malware)"; content:"|0d|bestsocksshop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betterpeony.com (malware)"; content:"|0b|betterpeony|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibliographicdata.com (malware)"; content:"|11|bibliographicdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigeasysite.com (malware)"; content:"|0b|bigeasysite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bilgimotoru.com (backdoor)"; content:"|0b|bilgimotoru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biohard.com.br (worm_bagle)"; content:"|07|biohard|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjdfld.com (exploits )"; content:"|06|bjdfld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluemagiccharters.com (backdoor)"; content:"|11|bluemagiccharters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boiiiiod.com (exploit)"; content:"|08|boiiiiod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boiledfan.net (exploits)"; content:"|09|boiledfan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borowczyk.blink.pl (backdoor)"; content:"|09|borowczyk|05|blink|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bramblewoodpress.com (malware)"; content:"|10|bramblewoodpress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broodjeszaakdenieuwerai.nl (backdoor)"; content:"|17|broodjeszaakdenieuwerai|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carderplanet.me (zeus/wsnpoem)"; content:"|0c|carderplanet|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cartavalurbana.com (backdoor)"; content:"|0e|cartavalurbana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casasolar2010brasil.com.br (backdoor)"; content:"|13|casasolar2010brasil|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catmur.com (malware)"; content:"|06|catmur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup catolicanet.net (malware)"; content:"|0b|catolicanet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charitytopeople.com (malware)"; content:"|0f|charitytopeople|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkin.ignorelist.com (malware)"; content:"|07|checkin|0a|ignorelist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherubet.co.ke (zeus/wsnpoem)"; content:"|08|cherubet|02|co|02|ke"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrisownzu.com (malware)"; content:"|0a|chrisownzu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cibercuentos.org (malware)"; content:"|0c|cibercuentos|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citroen-saintlouis.com (backdoor)"; content:"|12|citroen-saintlouis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubrange.net (backdoor)"; content:"|09|clubrange|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coconutsclub.fr (backdoor)"; content:"|0c|coconutsclub|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colocation-srv01.cartrade.com.br (backdoor)"; content:"|10|colocation-srv01|08|cartrade|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comega.es (malware)"; content:"|06|comega|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computersolution3.com (malware)"; content:"|11|computersolution3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comseguranca.org (trojan)"; content:"|0c|comseguranca|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contempoarte.com.br (backdoor)"; content:"|0c|contempoarte|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corpdonates.org (malware)"; content:"|0b|corpdonates|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corretoresdeseguros.com.br (malware)"; content:"|13|corretoresdeseguros|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crcatb.fr (backdoor)"; content:"|06|crcatb|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csrimini.it (backdoor)"; content:"|08|csrimini|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d0ing.net (malware)"; content:"|05|d0ing|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup danshippingbelize.com (trojan)"; content:"|11|danshippingbelize|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daucke.dk (backdoor)"; content:"|06|daucke|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doluong.gov.vn (malware)"; content:"|07|doluong|03|gov|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domafon.info (malware)"; content:"|07|domafon|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doyac.kr (malware)"; content:"|05|doyac|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup duofee.com (malware)"; content:"|06|duofee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dupouy-charpente.fr (backdoor)"; content:"|10|dupouy-charpente|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynamic-methods.com (threat)"; content:"|0f|dynamic-methods|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eatsleepbingo.co.uk (malware)"; content:"|0d|eatsleepbingo|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eioiusd.in (neosploit)"; content:"|07|eioiusd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ellipseimage.com (backdoor)"; content:"|0c|ellipseimage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endeavor-enterprises.com (malware)"; content:"|14|endeavor-enterprises|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exprm.com (harmful)"; content:"|05|exprm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook-space.co.cc (malware)"; content:"|0e|facebook-space|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fafu.prv.pl (hacktool)"; content:"|04|fafu|03|prv|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faithbibletabernacle.org (exploits )"; content:"|14|faithbibletabernacle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fapebook.com (malware)"; content:"|08|fapebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiddler2.com (malware)"; content:"|08|fiddler2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmcommissionpiacenza.it (malware)"; content:"|16|filmcommissionpiacenza|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flahert.bget.ru (malware)"; content:"|07|flahert|04|bget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flesalbook.com (malware)"; content:"|0a|flesalbook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floundering.info (exploit)"; content:"|0b|floundering|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fooofle.ru (malware)"; content:"|07|fooofle|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup formandosunidf.com (malware)"; content:"|0e|formandosunidf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foto-myspace.com (malware)"; content:"|0c|foto-myspace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fottie.com (malware)"; content:"|06|fottie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxhom.com (backdoor)"; content:"|06|foxhom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fozdegen.com (malware)"; content:"|08|fozdegen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup francobonaventura.net (backdoor)"; content:"|11|francobonaventura|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freenetflash.com (malware)"; content:"|0c|freenetflash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeviewdvd.com (malware)"; content:"|0b|freeviewdvd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frensomo.com (malware)"; content:"|08|frensomo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fullanguage.com (malware)"; content:"|0b|fullanguage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fundacionasilo.com (malware)"; content:"|0e|fundacionasilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaoav8.info (malware)"; content:"|06|gaoav8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdso.es (backdoor)"; content:"|04|gdso|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gezhen.com (malware)"; content:"|06|gezhen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalteflschool.com (malware)"; content:"|10|globalteflschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golsoil.net (malware)"; content:"|07|golsoil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleadsenstats.ru (malware)"; content:"|10|googleadsenstats|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gourmetinstyle.com (malware)"; content:"|0e|gourmetinstyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackingnation.org (malware)"; content:"|0d|hackingnation|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellokittyn.tw (malware)"; content:"|0b|hellokittyn|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hidayeterkan.com (backdoor)"; content:"|0c|hidayeterkan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiddenowned.viefirehosting.com (malware)"; content:"|0b|hiddenowned|0e|viefirehosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holdtech.com.br (backdoor)"; content:"|08|holdtech|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup httpeds2.xpg.com.br (malware)"; content:"|08|httpeds2|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup id-tester.info (exploits)"; content:"|09|id-tester|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifgfgseithr.com (malware)"; content:"|0b|ifgfgseithr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ignclan.com (malware)"; content:"|07|ignclan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihjcwjbithr.com (malware)"; content:"|0b|ihjcwjbithr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img.ub8.net (malware)"; content:"|03|img|03|ub8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imphotos-myspace.com (trojan)"; content:"|10|imphotos-myspace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instanzen.fr (worm_bagle)"; content:"|09|instanzen|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instat.in (fraud)"; content:"|06|instat|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetcosmeguranca.sitebr.net (trojan)"; content:"|14|internetcosmeguranca|06|sitebr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ioi.gr (malware)"; content:"|03|ioi|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issto.com (malware)"; content:"|05|issto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iuo.interfree.it (malware)"; content:"|03|iuo|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jackpotspin.com (malware)"; content:"|0b|jackpotspin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jahat.zoomshare.com (malware)"; content:"|05|jahat|09|zoomshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgtdirect.com (malware)"; content:"|09|jgtdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jpx-arq.com (malware)"; content:"|07|jpx-arq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jujiafu.com (malware)"; content:"|07|jujiafu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kltec-consult.de (malware)"; content:"|0d|kltec-consult|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kmr88.cn (malware)"; content:"|05|kmr88|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ku.installstorm.com (malware)"; content:"|02|ku|0c|installstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacasadigital.com (backdoor)"; content:"|0d|lacasadigital|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacongregacion.es (backdoor)"; content:"|0e|lacongregacion|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup layoutpress.xpg.com.br (malware)"; content:"|0b|layoutpress|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liaynoxlthr.com (malware)"; content:"|0b|liaynoxlthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup littlecommon.net (exploits)"; content:"|0c|littlecommon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lokoxxx.hi2.ro (trojan )"; content:"|07|lokoxxx|03|hi2|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lorienvana.com.tw (exploits )"; content:"|0a|lorienvana|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luzdehadas.es (backdoor)"; content:"|0a|luzdehadas|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzwrc.com (harmful)"; content:"|05|lzwrc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup majesticthailand.com (backdoor)"; content:"|10|majesticthailand|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manhandled.info (exploits)"; content:"|0a|manhandled|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marmolesexoticos.com (backdoor)"; content:"|10|marmolesexoticos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mecklenburgva.com (malware)"; content:"|0d|mecklenburgva|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaplayeronline.com (malware)"; content:"|11|mediaplayeronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaprotect.co.kr (malware)"; content:"|0b|megaprotect|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merchant-hello.com (malware)"; content:"|0e|merchant-hello|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsofj.com (malware)"; content:"|09|microsofj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ministerioalfa.com.br (backdoor)"; content:"|0e|ministerioalfa|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mourasoft.eti.br (backdoor)"; content:"|09|mourasoft|03|eti|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-myspace1.com (malware)"; content:"|0c|msn-myspace1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mspace-img.com (malware)"; content:"|0a|mspace-img|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muas.in (malware)"; content:"|04|muas|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimedicacentro.com (backdoor)"; content:"|11|multimedicacentro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycool-photo.com (malware)"; content:"|0c|mycool-photo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygollar.com (exploits)"; content:"|08|mygollar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mythriiproduction.com (malware)"; content:"|11|mythriiproduction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n-sc.gov.sa (malware)"; content:"|04|n-sc|03|gov|02|sa"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naja777.extra.hu (exploits )"; content:"|07|naja777|05|extra|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nbwt.in (exploits)"; content:"|04|nbwt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ndisnpp.in (threat)"; content:"|07|ndisnpp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neon-cardaras.com (malware)"; content:"|0d|neon-cardaras|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netinlive.com (backdoor)"; content:"|09|netinlive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettland.org (malware)"; content:"|08|nettland|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netvideoinfo.com (malware)"; content:"|0c|netvideoinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhuas.cn (malware)"; content:"|07|newhuas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninjadove.net (malware)"; content:"|09|ninjadove|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nit-picky.info (exploits)"; content:"|09|nit-picky|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nottisiciliane.com (backdoor)"; content:"|0e|nottisiciliane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obkom.net.ua (iframe)"; content:"|05|obkom|03|net|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ogagarin.com (zeus/wsnpoem)"; content:"|08|ogagarin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldar.eu (backdoor)"; content:"|05|oldar|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peartreevideo.com (backdoor)"; content:"|0d|peartreevideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peltelk.com (exploit)"; content:"|07|peltelk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacenter.gr (backdoor)"; content:"|0c|pharmacenter|02|gr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planetperfumes.co.uk (malware)"; content:"|0e|planetperfumes|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planit3d.com (worm_bagle)"; content:"|08|planit3d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poesieinversi.netsons.org (backdoor)"; content:"|0d|poesieinversi|07|netsons|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portalmanancial.com.br (backdoor)"; content:"|0f|portalmanancial|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacyclean.co.kr (malware)"; content:"|0c|privacyclean|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privadodeluxo.com (backdoor)"; content:"|0d|privadodeluxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privateoo.com (malware)"; content:"|09|privateoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pronauti.com (malware)"; content:"|08|pronauti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pvefc.org (malware)"; content:"|05|pvefc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qdnhouse.com (malware)"; content:"|08|qdnhouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qeprotect.in (malware)"; content:"|09|qeprotect|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queseriavallesdeloso.com (backdoor)"; content:"|14|queseriavallesdeloso|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickresponsetech.com (exploit)"; content:"|11|quickresponsetech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ras.ac.th (exploits)"; content:"|03|ras|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup re05.o6c7.com (malware)"; content:"|04|re05|04|o6c7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recover777.com (malware)"; content:"|0a|recover777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recover7777.com (malware)"; content:"|0b|recover7777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redefarol.com.br (backdoor)"; content:"|09|redefarol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockfordlodge140il.org (malware)"; content:"|12|rockfordlodge140il|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup run.rrob.net (hacktool)"; content:"|03|run|04|rrob|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rusdrivers.spb.ru (malware)"; content:"|0a|rusdrivers|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s31.freecause.com (malware)"; content:"|03|s31|09|freecause|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s92091163.onlinehome.us (backdoor)"; content:"|09|s92091163|0a|onlinehome|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samer1.net (malware)"; content:"|06|samer1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samsonchanfilms.com (threat)"; content:"|0f|samsonchanfilms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saverzz.com (malware)"; content:"|07|saverzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdracius.com (hacktool)"; content:"|08|sdracius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seclinezzz.net (malware)"; content:"|0a|seclinezzz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sentenced121.info (exploit)"; content:"|0c|sentenced121|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serv-state.ru (rogue)"; content:"|0a|serv-state|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servifis.es (backdoor)"; content:"|08|servifis|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servstate.ru (rogue)"; content:"|09|servstate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sevgiseliniz.net (malware)"; content:"|0c|sevgiseliniz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shiraziali.com (backdoor)"; content:"|0a|shiraziali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopnon.com (malware)"; content:"|07|shopnon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sigoretizlo.com (neosploit)"; content:"|0b|sigoretizlo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup songinnight.nayana.com (worm_bagle)"; content:"|0b|songinnight|06|nayana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonyericsson.lua.pl (trojan )"; content:"|0c|sonyericsson|03|lua|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacebits.com (backdoor)"; content:"|09|spacebits|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-checker-free.com (malware)"; content:"|14|spyware-checker-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-checker-free.net (malware)"; content:"|14|spyware-checker-free|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-checker-free.org (malware)"; content:"|14|spyware-checker-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stannestifton.com (malware)"; content:"|0d|stannestifton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup state-anis.ru (rogue)"; content:"|0a|state-anis|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup state-serv.ru (rogue)"; content:"|0a|state-serv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strcolatina.com.br (backdoor)"; content:"|0b|strcolatina|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streetmusic.pl (malware)"; content:"|0b|streetmusic|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stvparkcomputer.info (zeus/wsnpoem)"; content:"|0f|stvparkcomputer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfilesonline.com (malware)"; content:"|10|superfilesonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfilm24.altervista.org (malware)"; content:"|0b|superfilm24|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sydl.gov.cn (malware)"; content:"|04|sydl|03|gov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tatarstan.ws (malware)"; content:"|09|tatarstan|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup techzoneplus.com (malware)"; content:"|0c|techzoneplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tempoeletronicos.com.br (malware)"; content:"|10|tempoeletronicos|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thatsdesign.it (malware)"; content:"|0b|thatsdesign|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thechances.com (backdoor)"; content:"|0a|thechances|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thefilesseason.com (malware)"; content:"|0e|thefilesseason|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trosken.com (malware)"; content:"|07|trosken|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udtelde.es (backdoor)"; content:"|07|udtelde|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ulbjqupw.cn (malware)"; content:"|08|ulbjqupw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unbureauenplus.fr (backdoor)"; content:"|0e|unbureauenplus|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatemania.info (malware)"; content:"|0b|updatemania|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup userprivileges.net (malware)"; content:"|0e|userprivileges|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uytrec.cn (zeus/wsnpoem)"; content:"|06|uytrec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vafljam.net (malware)"; content:"|07|vafljam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaquerodecoracion.com (backdoor)"; content:"|11|vaquerodecoracion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbcveeuvthr.com (malware)"; content:"|0b|vbcveeuvthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup virusdefender.org (malware)"; content:"|0d|virusdefender|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visualdiz.com (backdoor)"; content:"|09|visualdiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vtblowoff.com (malware)"; content:"|09|vtblowoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv-port.cult.bg (backdoor)"; content:"|07|vv-port|04|cult|02|bg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web.92npc.com (trojan )"; content:"|03|web|05|92npc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webeupload.in (malware)"; content:"|0a|webeupload|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmail.raol.com.br (malware)"; content:"|07|webmail|04|raol|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wedding.saranghea.net (malware)"; content:"|07|wedding|09|saranghea|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wellkoon.com (malware)"; content:"|08|wellkoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westman.cn (trojan )"; content:"|07|westman|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wild8teen.com (malware)"; content:"|09|wild8teen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winemylips.be (malware)"; content:"|0a|winemylips|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winforever.netsons.org (backdoor)"; content:"|0a|winforever|07|netsons|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world-immortal.org (malware)"; content:"|0e|world-immortal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvzz.nl (backdoor)"; content:"|04|wvzz|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xell2010.xpg.com.br (malware)"; content:"|08|xell2010|03|xpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xzz.mtv00.cn (trojan )"; content:"|03|xzz|05|mtv00|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yaguang.co.kr (backdoor)"; content:"|07|yaguang|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z0-security.eu (rogue)"; content:"|0b|z0-security|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z8-security.eu (rogue)"; content:"|0b|z8-security|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarzueleros.com (backdoor)"; content:"|0b|zarzueleros|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenessens.fr (backdoor)"; content:"|09|zenessens|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zurk.in (malware)"; content:"|04|zurk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 18-plus.ru (gumblar)"; content:"|07|18-plus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a.rodfirst.com (exploit)"; content:"|01|a|08|rodfirst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeffeqdafir.com (harmful)"; content:"|0b|aeffeqdafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefptpnafir.com (trojan)"; content:"|0b|aefptpnafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefuoesafir.com (harmful)"; content:"|0b|aefuoesafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup airseasite.ru (gumblar)"; content:"|0a|airseasite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiiuuhafir.com (harmful)"; content:"|0b|ajiiuuhafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajiopwmafir.com (harmful)"; content:"|0b|ajiopwmafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allmyguide.ru (rbn)"; content:"|0a|allmyguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allmysport.ru (rbn)"; content:"|0a|allmysport|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnewface.ru (gumblar)"; content:"|0a|allnewface|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allpropro.ru (gumblar)"; content:"|09|allpropro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apple-downloads.net (fraud/scam)"; content:"|0f|apple-downloads|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apple-resellers.net (fraud/scam)"; content:"|0f|apple-resellers|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assetmancomcareers.com (malware)"; content:"|12|assetmancomcareers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup authenticsoftware.net (fraud/scam)"; content:"|11|authenticsoftware|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup autotropolis.com (harmful)"; content:"|0c|autotropolis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup availablemix.ru (rbn)"; content:"|0c|availablemix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avattop.ru (risk)"; content:"|07|avattop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup battop.ru (safebrowsing)"; content:"|06|battop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bayjail.ru (risk)"; content:"|07|bayjail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbcwwhubfir.com (trojan)"; content:"|0b|bbcwwhubfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beachdoo.ru (threat)"; content:"|08|beachdoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beeeo.ru (gumblar)"; content:"|05|beeeo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup before-this-life.ru (gumblar)"; content:"|10|before-this-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestage.ru (gumblar)"; content:"|07|bestage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbidline.ru (safebrowsing)"; content:"|0b|bestbidline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbio.ru (gumblar)"; content:"|07|bestbio|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestblenderpart.ru (safebrowsing)"; content:"|0f|bestblenderpart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestbondsite.ru (gumblar)"; content:"|0c|bestbondsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdarkstar.info (safebrowsing)"; content:"|0c|bestdarkstar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmyfree.ru (safebrowsing)"; content:"|0a|bestmyfree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnewhaven.ru (gumblar)"; content:"|0c|bestnewhaven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnewsmall.ru (risk)"; content:"|0c|bestnewsmall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestseasilver.ru (threat)"; content:"|0d|bestseasilver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bi-test.ru (gumblar)"; content:"|07|bi-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bidtradebuy.ru (gumblar)"; content:"|0b|bidtradebuy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigfiredomain.com (threat)"; content:"|0d|bigfiredomain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bihsecurity.com (trojan )"; content:"|0b|bihsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bill4best.com (fraud/scam)"; content:"|09|bill4best|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biltop.ru (gumblar)"; content:"|06|biltop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-age.ru (gumblar)"; content:"|07|bio-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-free.ru (gumblar)"; content:"|08|bio-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-oib.ru (gumblar)"; content:"|07|bio-oib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-tube.ru (gumblar)"; content:"|08|bio-tube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bio-z.ru (gumblar)"; content:"|05|bio-z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bionaft.ru (gumblar)"; content:"|07|bionaft|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biovoz.ru (gumblar)"; content:"|06|biovoz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitest.ru (gumblar)"; content:"|06|bitest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacktagteam.ru (threat)"; content:"|0c|blacktagteam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluejackin.ru (gumblar)"; content:"|0a|bluejackin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluejackmusic.ru (gumblar)"; content:"|0d|bluejackmusic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blueseaguide.ru (gumblar)"; content:"|0c|blueseaguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breathconditioning.ru (malware)"; content:"|12|breathconditioning|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brownbagbar.ru (gumblar)"; content:"|0b|brownbagbar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brynetka.ru (gumblar)"; content:"|08|brynetka|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buy-software-shop.com (fraud/scam)"; content:"|11|buy-software-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buytheblender.ru (safebrowsing)"; content:"|0d|buytheblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cangethelp.ru (virus)"; content:"|0a|cangethelp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheatsin.ru (virus)"; content:"|08|cheatsin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cherrypieusa.ru (virus)"; content:"|0c|cherrypieusa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearsitedesign.ru (threat)"; content:"|0f|clearsitedesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connection-billing.com (fraud/scam)"; content:"|12|connection-billing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolsitemap.ru (harmful)"; content:"|0b|coolsitemap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cottagworld.ru (threat)"; content:"|0b|cottagworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countyhomeworld.ru (threat)"; content:"|0f|countyhomeworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countypath.ru (threat)"; content:"|0a|countypath|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxanoeiurxwv.com (harmful)"; content:"|0c|cxanoeiurxwv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberprotech.ru (gumblar)"; content:"|0c|cyberprotech|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybertagonline.ru (virus)"; content:"|0e|cybertagonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyoeiuwfdxqg.com (trojan)"; content:"|0c|cyoeiuwfdxqg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddfgdsa4.info (neosploit)"; content:"|08|ddfgdsa4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deluxediscounter.com (fraud/scam)"; content:"|10|deluxediscounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalsiteonline.ru (malicious)"; content:"|11|digitalsiteonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discountsuperblender.ru (threat)"; content:"|14|discountsuperblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastmusicdirect.ru (gumblar)"; content:"|0f|eastmusicdirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eastparkonline.ru (threat)"; content:"|0e|eastparkonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyfunguide.at (safebrowsing)"; content:"|0c|easyfunguide|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easylifedirect.ru (gumblar)"; content:"|0e|easylifedirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup europenguide.ru (threat)"; content:"|0c|europenguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everywheremag.com (harmful)"; content:"|0d|everywheremag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellentblender.ru (safebrowsing)"; content:"|10|excellentblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezpoh.ru (gumblar)"; content:"|05|ezpoh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fazher.com (hack)"; content:"|06|fazher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ffggjaeffir.com (harmful)"; content:"|0b|ffggjaeffir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup first-shockabsorbers.com (threat)"; content:"|14|first-shockabsorbers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fixslow.ru (malware)"; content:"|07|fixslow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floridaorigin.at (safebrowsing)"; content:"|0d|floridaorigin|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forredtag.ru (safebrowsing)"; content:"|09|forredtag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxobkes.com (exploit)"; content:"|08|foxobkes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freemoviespark.co.cc (iframe)"; content:"|0e|freemoviespark|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup game-walkthrough.net (safebrowsing)"; content:"|10|game-walkthrough|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gametopsite.ru (gumblar)"; content:"|0b|gametopsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup generalcreate.net (malware)"; content:"|0d|generalcreate|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genuinehollywood.ru (safebrowsing)"; content:"|10|genuinehollywood|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genuinenorth.ru (malware)"; content:"|0c|genuinenorth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gewebsearch.com (hack)"; content:"|0b|gewebsearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gllftcptfelu.com (harmful)"; content:"|0c|gllftcptfelu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gnfkovajybh.com (harmful)"; content:"|0b|gnfkovajybh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatblenderguide.ru (threat)"; content:"|11|greatblenderguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatmyown.ru (threat)"; content:"|0a|greatmyown|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatsalecenter.ru (gumblar)"; content:"|0f|greatsalecenter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwestend.ru (safebrowsing)"; content:"|0c|greatwestend|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gridrevolutions.ru (risk)"; content:"|0f|gridrevolutions|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guzelsohbet.info (safebrowsing)"; content:"|0b|guzelsohbet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halfsite.ru (gumblar)"; content:"|08|halfsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heavycourt.ru (blacklist)"; content:"|0a|heavycourt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhjjqjghfir.com (trojan)"; content:"|0b|hhjjqjghfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highestdog.ru (malware)"; content:"|0a|highestdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homecarenation.ru (risk)"; content:"|0e|homecarenation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homehelpsell.ru (risk)"; content:"|0c|homehelpsell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesaleplus.ru (gumblar)"; content:"|0c|homesaleplus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesitedesigns.ru (gumblar)"; content:"|0f|homesitedesigns|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesitegroup.ru (suspicious)"; content:"|0d|homesitegroup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesweetdeal.ru (threat)"; content:"|0d|homesweetdeal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeusaonline.ru (risk)"; content:"|0d|homeusaonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostdnssite.com (spam)"; content:"|0b|hostdnssite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotnewguide.ru (safebrowsing)"; content:"|0b|hotnewguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huntalong.ru (gumblar)"; content:"|09|huntalong|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huzzahwebdesign.ru (gumblar)"; content:"|0f|huzzahwebdesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icychina.ru (safebrowsing)"; content:"|08|icychina|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifuckedthebabysitter.com (risk)"; content:"|14|ifuckedthebabysitter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iigsvjwmavp.com (harmful)"; content:"|0b|iigsvjwmavp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inother.ru (gumblar)"; content:"|07|inother|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabqxrojfir.com (harmful)"; content:"|0b|jabqxrojfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javahelponline.ru (blacklist)"; content:"|0e|javahelponline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jerseyhomesite.ru (safebrowsing)"; content:"|0e|jerseyhomesite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krenhuik9.com (exploit)"; content:"|09|krenhuik9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwwzlvixkhv.com (harmful)"; content:"|0b|kwwzlvixkhv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup law-to-da.com (malspam)"; content:"|09|law-to-da|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limowebcam.ru (malware)"; content:"|0a|limowebcam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livesitedesign.ru (safebrowsing)"; content:"|0e|livesitedesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lk01ha71gg1.cc (malware)"; content:"|0b|lk01ha71gg1|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mansbestsite.ru (risk)"; content:"|0c|mansbestsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maxserviceworld.ru (gumblar)"; content:"|0f|maxserviceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazcostrol.com (hack)"; content:"|0a|mazcostrol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcdwhbvmthr.com (trojan)"; content:"|0b|mcdwhbvmthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediatagonline.ru (safebrowsing)"; content:"|0e|mediatagonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfdclk001.org (malware)"; content:"|09|mfdclk001|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mindgameworks.ru (gumblar)"; content:"|0d|mindgameworks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mingleas.ru (gumblar)"; content:"|08|mingleas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minilabdirect.ru (threat)"; content:"|0d|minilabdirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozg-testing.ru (gumblar)"; content:"|0c|mozg-testing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mozgilla.ru (gumblar)"; content:"|08|mozgilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicboxpro.ru (gumblar)"; content:"|0b|musicboxpro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycontentguide.ru (safebrowsing)"; content:"|0e|mycontentguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfreemag.ru (threat)"; content:"|09|myfreemag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygreatsale.ru (gumblar)"; content:"|0b|mygreatsale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myownage.ru (threat)"; content:"|08|myownage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myownchart.ru (threat)"; content:"|0a|myownchart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysitedot.ru (threat)"; content:"|09|mysitedot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myskysite.ru (threat)"; content:"|09|myskysite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myworldcampus.ru (threat)"; content:"|0d|myworldcampus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myworldcause.ru (threat)"; content:"|0c|myworldcause|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needserve.ru (threat)"; content:"|09|needserve|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neolabonline.ru (threat)"; content:"|0c|neolabonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netmusicbank.ru (safebrowsing)"; content:"|0c|netmusicbank|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netwayguide.ru (harmful)"; content:"|0b|netwayguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newagedirect.ru (safebrowsing)"; content:"|0c|newagedirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newgolfonline.ru (risk)"; content:"|0d|newgolfonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhavenparks.ru (gumblar)"; content:"|0d|newhavenparks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newhelloworld.ru (safebrowsing)"; content:"|0d|newhelloworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsafetyplace.com (malware)"; content:"|0e|newsafetyplace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsourceworld.ru (risk)"; content:"|0e|newsourceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsunsite.ru (threat)"; content:"|0a|newsunsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newusaguide.ru (safebrowsing)"; content:"|0b|newusaguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newvillagefresh.ru (risk)"; content:"|0f|newvillagefresh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newworlddog.ru (threat)"; content:"|0b|newworlddog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newworldlink.ru (risk)"; content:"|0c|newworldlink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nowhomecare.ru (risk)"; content:"|0b|nowhomecare|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns354262.ovh.net (malware)"; content:"|08|ns354262|03|ovh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuanscafenur97.com (safebrowsing)"; content:"|0e|nuanscafenur97|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuchycnsqmcg.com (harmful)"; content:"|0c|nuchycnsqmcg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onfareast.ru (threat)"; content:"|09|onfareast|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onotolexx.ru (exploit)"; content:"|09|onotolexx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opaasep.co.uk (phish)"; content:"|07|opaasep|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup openairmall.ru (threat)"; content:"|0b|openairmall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osfqdipetizz.com (trojan)"; content:"|0c|osfqdipetizz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pastanotherlife.ru (gumblar)"; content:"|0f|pastanotherlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pathcool.ru (malware)"; content:"|08|pathcool|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pbcrcmppfir.com (trojan)"; content:"|0b|pbcrcmppfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pepd.org (trojan)"; content:"|04|pepd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photomaxlab.ru (threat)"; content:"|0b|photomaxlab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piecityonline.ru (threat)"; content:"|0d|piecityonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup propluslab.ru (threat)"; content:"|0a|propluslab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reachsaw.ru (malware)"; content:"|08|reachsaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readystockonline.ru (blacklist)"; content:"|10|readystockonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realhelpguide.ru (threat)"; content:"|0d|realhelpguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recentmexico.ru (gumblar)"; content:"|0c|recentmexico|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redseaportal.ru (threat)"; content:"|0c|redseaportal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redsunpark.info (blacklist)"; content:"|0a|redsunpark|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redtagcentral.ru (risk)"; content:"|0d|redtagcentral|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redtagcruises.ru (risk)"; content:"|0d|redtagcruises|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redtagjewelers.ru (risk)"; content:"|0e|redtagjewelers|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redtagjewelry.ru (risk)"; content:"|0d|redtagjewelry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retireterrify.ru (safebrowsing)"; content:"|0d|retireterrify|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roadavailable.ru (threat)"; content:"|0d|roadavailable|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saletradeonline.ru (gumblar)"; content:"|0f|saletradeonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samuest.ru (risk)"; content:"|07|samuest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seasilversite.ru (risk)"; content:"|0d|seasilversite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoozi.ru (gumblar)"; content:"|06|shoozi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplehomelink.ru (gumblar)"; content:"|0e|simplehomelink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simpleworldhouse.ru (gumblar)"; content:"|10|simpleworldhouse|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitedesigninc.ru (safebrowsing)"; content:"|0d|sitedesigninc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitemape.ru (safebrowsing)"; content:"|08|sitemape|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitemyworld.ru (threat)"; content:"|0b|sitemyworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitesages.ru (gumblar)"; content:"|09|sitesages|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitesolutionplace.ru (risk)"; content:"|11|sitesolutionplace|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitetotest.com (exploit)"; content:"|0a|sitetotest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snoreflash.ru (safebrowsing)"; content:"|0a|snoreflash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyeraser-security.com (rogue)"; content:"|12|spyeraser-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyeraser-software.com (rogue)"; content:"|12|spyeraser-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stareastwork.ru (threat)"; content:"|0c|stareastwork|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sugaryhome.ru (gumblar)"; content:"|0a|sugaryhome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suncitynet.ru (threat)"; content:"|0a|suncitynet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superbblender.ru (blacklist)"; content:"|0d|superbblender|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superblendersite.ru (blacklist)"; content:"|10|superblendersite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superhighest.ru (safebrowsing)"; content:"|0c|superhighest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermallhome.ru (blacklist)"; content:"|0d|supermallhome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermariodirect.ru (safebrowsing)"; content:"|10|supermariodirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermicrotag.ru (safebrowsing)"; content:"|0d|supermicrotag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supermyweb.ru (blacklist)"; content:"|0a|supermyweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supernewstuff.ru (risk)"; content:"|0d|supernewstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superprepared.ru (blacklist)"; content:"|0d|superprepared|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superseatoddy.ru (gumblar)"; content:"|0d|superseatoddy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superseawind.ru (gumblar)"; content:"|0c|superseawind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersuperclub.ru (blacklist)"; content:"|0e|supersuperclub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersupermall.ru (safebrowsing)"; content:"|0e|supersupermall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersupersale.ru (blacklist)"; content:"|0e|supersupersale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersupervisor.ru (safebrowsing)"; content:"|0f|supersupervisor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superwestvalley.ru (blacklist)"; content:"|0f|superwestvalley|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susance.ru (gumblar)"; content:"|07|susance|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweethomesale.ru (malware)"; content:"|0d|sweethomesale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagsaleusa.ru (safebrowsing)"; content:"|0a|tagsaleusa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagteamexpo.ru (threat)"; content:"|0b|tagteamexpo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamhotworld.ru (threat)"; content:"|0c|teamhotworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teenwebdesign.ru (gumblar)"; content:"|0d|teenwebdesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theantimatrix.ru (risk)"; content:"|0d|theantimatrix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theblendertutorial.ru (safebrowsing)"; content:"|12|theblendertutorial|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theblendertv.ru (safebrowsing)"; content:"|0c|theblendertv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegiftsale.ru (gumblar)"; content:"|0b|thegiftsale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thehelpbot.ru (iframe)"; content:"|0a|thehelpbot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thehomedisc.ru (threat)"; content:"|0b|thehomedisc|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thehomelabs.ru (risk)"; content:"|0b|thehomelabs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelifetag.ru (safebrowsing)"; content:"|0a|thelifetag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thestorelab.ru (threat)"; content:"|0b|thestorelab|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesuperexchange.ru (safebrowsing)"; content:"|10|thesuperexchange|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thesuperpager.ru (thr)"; content:"|0d|thesuperpager|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetruehelp.ru (safebrowsing)"; content:"|0b|thetruehelp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thewestrim.ru (risk)"; content:"|0a|thewestrim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thjxblvtfir.com (trojan)"; content:"|0b|thjxblvtfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tmphos.net (trojan )"; content:"|06|tmphos|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toplinemarine.ru (malware)"; content:"|0d|toplinemarine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truerealtime.ru (malware)"; content:"|0c|truerealtime|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truesoulonline.ru (safebrowsing)"; content:"|0e|truesoulonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trueworldmedia.ru (safebrowsing)"; content:"|0e|trueworldmedia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultracoolserver.de (malware)"; content:"|0f|ultracoolserver|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urlnext.ru (gumblar)"; content:"|07|urlnext|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vancatch.ru (malware)"; content:"|08|vancatch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbcrckpvfir.com (trojan)"; content:"|0b|vbcrckpvfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfgplnovthr.com (trojan)"; content:"|0b|vfgplnovthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videohotmix.ru (safebrowsing)"; content:"|0b|videohotmix|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videosaleonline.ru (gumblar)"; content:"|0f|videosaleonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewhomesale.ru (gumblar)"; content:"|0c|viewhomesale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup votrelib.ru (gumblar)"; content:"|08|votrelib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vqpmvhfboy.com (harmful)"; content:"|0a|vqpmvhfboy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrqrjocbkkr.com (trojan)"; content:"|0b|vrqrjocbkkr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wabkvtiwthr.com (trojan)"; content:"|0b|wabkvtiwthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wavebank.ru (threat)"; content:"|08|wavebank|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wayoutmall.ru (threat)"; content:"|0a|wayoutmall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wayradio.ru (threat)"; content:"|08|wayradio|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wcmhlufeaqa.com (trojan)"; content:"|0b|wcmhlufeaqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmixworld.ru (safebrowsing)"; content:"|0b|webmixworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpowerguide.ru (gumblar)"; content:"|0d|webpowerguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webworldshop.ru (malware)"; content:"|0c|webworldshop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup welcomepresent.ru (threat)"; content:"|0e|welcomepresent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westworldweb.ru (threat)"; content:"|0c|westworldweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whosaleonline.ru (gumblar)"; content:"|0d|whosaleonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wintersaleonline.ru (gumblar)"; content:"|10|wintersaleonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldhighspeed.ru (gumblar)"; content:"|0e|worldhighspeed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcpoydxpfpn.com (harmful)"; content:"|0b|xcpoydxpfpn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xghvhwiqrrxn.com (harmful)"; content:"|0c|xghvhwiqrrxn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xgirls.ru (safebrowsing)"; content:"|06|xgirls|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxlwebhost.ru (malware)"; content:"|0a|xxlwebhost|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xzcpoydxpfpn.com (trojan)"; content:"|0c|xzcpoydxpfpn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yahoo-banner.biz (exploit)"; content:"|0c|yahoo-banner|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesdearsite.ru (threat)"; content:"|0b|yesdearsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yetanotherserver.com (exploit)"; content:"|10|yetanotherserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youhelpnow.ru (virus)"; content:"|0a|youhelpnow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourasite.ru (gumblar)"; content:"|09|yourasite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourblendermagazine.ru (threat)"; content:"|13|yourblendermagazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourblenderparts.ru (risk)"; content:"|10|yourblenderparts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourhotelsite.ru (gumblar)"; content:"|0d|yourhotelsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yournewzip.ru (harmful)"; content:"|0a|yournewzip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourreadykit.ru (blacklist)"; content:"|0c|yourreadykit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourreadynow.ru (gumblar)"; content:"|0c|yourreadynow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursunvalley.ru (gumblar)"; content:"|0d|yoursunvalley|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursuperpool.ru (safebrowsing)"; content:"|0d|yoursuperpool|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtagheuer.ru (risk)"; content:"|0c|yourtagheuer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtolltag.ru (risk)"; content:"|0b|yourtolltag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtopfilms.ru (malware)"; content:"|0c|yourtopfilms|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourtruecrime.ru (safebrowsing)"; content:"|0d|yourtruecrime|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zikkuat.com (malware)"; content:"|07|zikkuat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zxclk9abnz72.com (malware)"; content:"|0c|zxclk9abnz72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 371.net (malware)"; content:"|03|371|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4238789324.com (threat)"; content:"|0a|4238789324|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 66aa.org (malware)"; content:"|04|66aa|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9966.org (malicious)"; content:"|04|9966|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup akmarsa.com (threat)"; content:"|07|akmarsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alhatester.com (malware)"; content:"|0a|alhatester|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aopsompamspn.com (threat)"; content:"|0c|aopsompamspn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup auto-putz.com (malware)"; content:"|09|auto-putz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aversbonko.com (malicious)"; content:"|0a|aversbonko|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b00tlife.com (malware)"; content:"|08|b00tlife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestantiv.com (malware)"; content:"|09|bestantiv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup binglbalts.com (exploit)"; content:"|0a|binglbalts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bitapardaz.net (malware)"; content:"|0a|bitapardaz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizevery.com (threat)"; content:"|08|bizevery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buckomre.com (malicious)"; content:"|08|buckomre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clydeford.com (malware)"; content:"|09|clydeford|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computersengines.com (harmful)"; content:"|10|computersengines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corpadsinc.com (exploit)"; content:"|0a|corpadsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crystaldesignlab.com (risk)"; content:"|10|crystaldesignlab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuitz.com (malware)"; content:"|05|cuitz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cupilostax.com (malicious)"; content:"|0a|cupilostax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dj-break.eu (malware)"; content:"|08|dj-break|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drevkatja.com (malware)"; content:"|09|drevkatja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwnk.in (malware)"; content:"|04|dwnk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endty.in (malware)"; content:"|05|endty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enoraup.com (malware)"; content:"|07|enoraup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup episodetwo.info (malware)"; content:"|0a|episodetwo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excellentblener.ru (malware)"; content:"|0f|excellentblener|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezuis.in (malware)"; content:"|05|ezuis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabooks-show.com (malware)"; content:"|0c|fabooks-show|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feromont4.ru (malware)"; content:"|09|feromont4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fourkingssports.com (exploit)"; content:"|0f|fourkingssports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g00gle-mega.com (malware)"; content:"|0b|g00gle-mega|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamesmegr2.ru (malware)"; content:"|0a|gamesmegr2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamesoci.ws (malware)"; content:"|08|gamesoci|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ganadineroenvenezuela.com (malware)"; content:"|15|ganadineroenvenezuela|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getcaughtup.org (malware)"; content:"|0b|getcaughtup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldvip21.com (malware)"; content:"|09|goldvip21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gonow99999.net (malware)"; content:"|0a|gonow99999|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-abalytics.info (malicious)"; content:"|10|google-abalytics|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-acalytics.info (malicious)"; content:"|10|google-acalytics|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googletwe.com (threat)"; content:"|09|googletwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosdfsdjas.com (malware)"; content:"|0a|gosdfsdjas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gova.ext-ab.info (malware)"; content:"|04|gova|06|ext-ab|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grinchalina2.com (malicious)"; content:"|0c|grinchalina2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grovelt.com (malware)"; content:"|07|grovelt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habbo.iplaying.de (malware)"; content:"|05|habbo|08|iplaying|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hndsa.net (malware)"; content:"|05|hndsa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homecem.net (malware)"; content:"|07|homecem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsudsasodams.com (trojan)"; content:"|0c|hsudsasodams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieksmanskasdk.com (malware)"; content:"|0d|ieksmanskasdk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iselix.no (malware)"; content:"|06|iselix|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ismrs.in (malware)"; content:"|05|ismrs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jbillu.net (malware)"; content:"|06|jbillu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jgzxe.com (threat)"; content:"|05|jgzxe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjast3z.com (malware)"; content:"|07|kjast3z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjdst6ey.com (malware)"; content:"|08|kjdst6ey|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ladiesofjuarez.com (malware)"; content:"|0e|ladiesofjuarez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lenina66.com (malware)"; content:"|08|lenina66|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainnetsoll.com (malware)"; content:"|0b|mainnetsoll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marflo.jexiste.fr (malware)"; content:"|06|marflo|07|jexiste|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mauiexperts.com (exploit)"; content:"|0b|mauiexperts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mauisportsinsider.com (exploit)"; content:"|11|mauisportsinsider|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcd0nalds.com (malware)"; content:"|09|mcd0nalds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdsget1.com (malware)"; content:"|07|mdsget1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meejnagyeuzi.info (malicious)"; content:"|0c|meejnagyeuzi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merchprices.com (malware)"; content:"|0b|merchprices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moremultimediaonline.com (malware)"; content:"|14|moremultimediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup morewaystech.com (malware)"; content:"|0c|morewaystech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movies-celeb.info (malware)"; content:"|0c|movies-celeb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-blocked.com (malware)"; content:"|0b|msn-blocked|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-img.net (malware)"; content:"|07|msn-img|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-verif.com (malware)"; content:"|09|msn-verif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msnapps.net (malware)"; content:"|07|msnapps|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mumukafes.net (malware)"; content:"|09|mumukafes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mwike.info (malware)"; content:"|05|mwike|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-image-gallery.net (malware)"; content:"|10|my-image-gallery|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybaby.hut.ru (malware)"; content:"|06|mybaby|03|hut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymujo.com (malware)"; content:"|06|mymujo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspace-view.com (malware)"; content:"|0c|myspace-view|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myviewcomp.com (malware)"; content:"|0a|myviewcomp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newisign.com (malware)"; content:"|08|newisign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlifei.com (malware)"; content:"|08|newlifei|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noncommittale.info (malware)"; content:"|0d|noncommittale|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ooxocentral.com (malware)"; content:"|0b|ooxocentral|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opudsjh.com (malware)"; content:"|07|opudsjh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psykiller.ws (malware)"; content:"|09|psykiller|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roxfen.com (malware)"; content:"|06|roxfen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sat-china.com (malicious)"; content:"|09|sat-china|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdasfj6.com (malware)"; content:"|07|sdasfj6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysections.com (malware)"; content:"|10|securitysections|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servtemp.info (malware)"; content:"|08|servtemp|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sodfirst.com (malware)"; content:"|08|sodfirst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soviet-malware.eu (malware)"; content:"|0e|soviet-malware|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superpuperporn.com (malware)"; content:"|0e|superpuperporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suscultural.net (malware)"; content:"|0b|suscultural|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup svchost1.webcindario.com (malware)"; content:"|08|svchost1|0b|webcindario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testforus.com (malware)"; content:"|09|testforus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theavagen.com (malware)"; content:"|09|theavagen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theflashfire.com (malware)"; content:"|0c|theflashfire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theflashone.com (malware)"; content:"|0b|theflashone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegabbean.com (malware)"; content:"|0a|thegabbean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tojanlea.com (fastflux)"; content:"|08|tojanlea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tom-massen.de (malware)"; content:"|0a|tom-massen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tormentos.interfree.it (malware)"; content:"|09|tormentos|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totanu.com (malware)"; content:"|06|totanu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup twidbeb3.com (malware)"; content:"|08|twidbeb3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyfaw.in (malware)"; content:"|05|tyfaw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uafeutue.com (fastflux)"; content:"|08|uafeutue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ufsl.lidonet.net (malware)"; content:"|04|ufsl|07|lidonet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usbdriverecovery.ws (malware)"; content:"|10|usbdriverecovery|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrdomainn.net (malware)"; content:"|0a|usrdomainn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usrdomainnertwesar.net (malware)"; content:"|12|usrdomainnertwesar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ustauwok2.com (malware)"; content:"|09|ustauwok2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uw99.com (malware)"; content:"|04|uw99|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdemindu.com (malware)"; content:"|0a|webdemindu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winrar392.net (malware)"; content:"|09|winrar392|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup witedirect.com (malware)"; content:"|0a|witedirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfgkddya.cn (malware)"; content:"|08|xfgkddya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yesoc.in (malware)"; content:"|05|yesoc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yetanotherguitarsite.com (malware)"; content:"|14|yetanotherguitarsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabbniyavmr.com (neosploit)"; content:"|0b|aabbniyavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-go1.com (fastflux_rogue)"; content:"|0f|antimalware-go1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-go2.com (fastflux_rogue)"; content:"|0f|antimalware-go2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-go4.com (fastflux_rogue)"; content:"|0f|antimalware-go4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-go5.com (fastflux_rogue)"; content:"|0f|antimalware-go5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-go7.com (fastflux_rogue)"; content:"|0f|antimalware-go7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-trial1.com (fastflux_rogue)"; content:"|12|antimalware-trial1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-trial3.com (fastflux_rogue)"; content:"|12|antimalware-trial3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-trial7.com (fastflux_rogue)"; content:"|12|antimalware-trial7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-trial9.com (fastflux_rogue)"; content:"|12|antimalware-trial9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaretrial5.com (fastflux_rogue)"; content:"|11|antimalwaretrial5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaretrial6.com (fastflux_rogue)"; content:"|11|antimalwaretrial6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaretrial7.com (fastflux_rogue)"; content:"|11|antimalwaretrial7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaretrial8.com (fastflux_rogue)"; content:"|11|antimalwaretrial8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwaretrial9.com (fastflux_rogue)"; content:"|11|antimalwaretrial9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online10.com (fastflux_rogue)"; content:"|10|antispy-online10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online20.com (fastflux_rogue)"; content:"|10|antispy-online20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online30.com (fastflux_rogue)"; content:"|10|antispy-online30|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online60.com (fastflux_rogue)"; content:"|10|antispy-online60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online80.com (fastflux_rogue)"; content:"|10|antispy-online80|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-online90.com (fastflux_rogue)"; content:"|10|antispy-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online20.com (fastflux_rogue)"; content:"|14|antispyware-online20|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online40.com (fastflux_rogue)"; content:"|14|antispyware-online40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online50.com (fastflux_rogue)"; content:"|14|antispyware-online50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online70.com (fastflux_rogue)"; content:"|14|antispyware-online70|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-online90.com (fastflux_rogue)"; content:"|14|antispyware-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online11.com (fastflux_rogue)"; content:"|12|antivirus-online11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online21.com (fastflux_rogue)"; content:"|12|antivirus-online21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online22.com (fastflux_rogue)"; content:"|12|antivirus-online22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online31.com (fastflux_rogue)"; content:"|12|antivirus-online31|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online32.com (fastflux_rogue)"; content:"|12|antivirus-online32|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online42.com (fastflux_rogue)"; content:"|12|antivirus-online42|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online51.com (fastflux_rogue)"; content:"|12|antivirus-online51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online52.com (fastflux_rogue)"; content:"|12|antivirus-online52|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-online71.com (fastflux_rogue)"; content:"|12|antivirus-online71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviruspluss.org (rogue)"; content:"|0e|antiviruspluss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scanner.org (rogue)"; content:"|11|av-online-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannercrest.org (rogue)"; content:"|16|av-online-scannercrest|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannergate.org (rogue)"; content:"|15|av-online-scannergate|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerland.org (rogue)"; content:"|15|av-online-scannerland|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannersite.org (rogue)"; content:"|15|av-online-scannersite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerweek.org (rogue)"; content:"|15|av-online-scannerweek|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-plus-online.org (rogue)"; content:"|0e|av-plus-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-plusonline.org (rogue)"; content:"|0d|av-plusonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-online.org (rogue)"; content:"|10|av-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-online3k.org (rogue)"; content:"|12|av-scaner-online3k|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinebody.org (rogue)"; content:"|14|av-scaner-onlinebody|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinegrinder.org (rogue)"; content:"|17|av-scaner-onlinegrinder|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinesite.org (rogue)"; content:"|14|av-scaner-onlinesite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner.org (rogue)"; content:"|09|av-scaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanner.org (rogue)"; content:"|0a|av-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanners.org (rogue)"; content:"|0b|av-scanners|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avbron.com (rogue)"; content:"|06|avbron|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcruiser.com (rogue)"; content:"|09|avcruiser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcybercop.com (rogue)"; content:"|0a|avcybercop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avector.net (rogue)"; content:"|07|avector|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avhunter.net (rogue)"; content:"|08|avhunter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avmaxsoft.com (rogue)"; content:"|09|avmaxsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avpatrol.net (rogue)"; content:"|08|avpatrol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplus-online.org (rogue)"; content:"|0d|avplus-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplusscanner.org (rogue)"; content:"|0d|avplusscanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avplussonline.org (rogue)"; content:"|0d|avplussonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avprotected.com (rogue)"; content:"|0b|avprotected|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsavior.com (rogue)"; content:"|08|avsavior|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscaner.org (rogue)"; content:"|08|avscaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscanner.org (rogue)"; content:"|09|avscanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsecurity.net (rogue)"; content:"|0a|avsecurity|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsoftsuite.com (rogue)"; content:"|0b|avsoftsuite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claronav.com (rogue)"; content:"|08|claronav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cremix.net (rogue)"; content:"|06|cremix|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directav-scaner-online.org (rogue)"; content:"|16|directav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doc-antispyware.com (Trojan )"; content:"|0f|doc-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docantispyware.com (Trojan )"; content:"|0e|docantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctorav.net (rogue)"; content:"|08|doctorav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dr-antispyware.com (Trojan )"; content:"|0e|dr-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drantispyware.com (Trojan )"; content:"|0d|drantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynaonline-scanner-free.org (rogue)"; content:"|17|dynaonline-scanner-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eav-scaner.org (rogue)"; content:"|0a|eav-scaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eav-scanner.org (rogue)"; content:"|0b|eav-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastonline-scanner-free.org (rogue)"; content:"|17|fastonline-scanner-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freens01.org (rogue)"; content:"|08|freens01|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getav.net (rogue)"; content:"|05|getav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-antimalware1.com (fastflux_rogue)"; content:"|0f|go-antimalware1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-antimalware3.com (fastflux_rogue)"; content:"|0f|go-antimalware3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-antimalware6.com (fastflux_rogue)"; content:"|0f|go-antimalware6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeonline-scanner-free.org (rogue)"; content:"|17|homeonline-scanner-free|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjtkmr6.com (exploit)"; content:"|07|kjtkmr6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovegreenstreet.com (rogue)"; content:"|0f|lovegreenstreet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madeunder.info (exploit)"; content:"|09|madeunder|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup master-antispyware.com (Trojan )"; content:"|12|master-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minoana.net (rogue)"; content:"|07|minoana|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myav-scaner.org (rogue)"; content:"|0b|myav-scaner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myav-scanner.org (rogue)"; content:"|0c|myav-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard.com (rogue)"; content:"|10|mysecuresysguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard.net (rogue)"; content:"|10|mysecuresysguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard1.com (rogue)"; content:"|11|mysecuresysguard1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard1.net (rogue)"; content:"|11|mysecuresysguard1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard2.com (rogue)"; content:"|11|mysecuresysguard2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard2.net (rogue)"; content:"|11|mysecuresysguard2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard3.com (rogue)"; content:"|11|mysecuresysguard3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard3.net (rogue)"; content:"|11|mysecuresysguard3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard4.com (rogue)"; content:"|11|mysecuresysguard4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard4.net (rogue)"; content:"|11|mysecuresysguard4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard5.com (rogue)"; content:"|11|mysecuresysguard5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard5.net (rogue)"; content:"|11|mysecuresysguard5|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard6.com (rogue)"; content:"|11|mysecuresysguard6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard6.net (rogue)"; content:"|11|mysecuresysguard6|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysecuresysguard7.com (rogue)"; content:"|11|mysecuresysguard7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netav-scaner-online.org (rogue)"; content:"|13|netav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niagrt.in (Trojan )"; content:"|06|niagrt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nicim.in (Trojan )"; content:"|05|nicim|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nickj.in (Trojan )"; content:"|05|nickj|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nickr.in (Trojan )"; content:"|05|nickr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nijrht.in (Trojan )"; content:"|06|nijrht|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns.ipp.com.ru (malicious)"; content:"|02|ns|03|ipp|03|com|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omegaav.net (rogue)"; content:"|07|omegaav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-protection.org (rogue)"; content:"|11|online-protection|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freebin.org (rogue)"; content:"|16|online-scanner-freebin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freebuy.org (rogue)"; content:"|16|online-scanner-freebuy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freelook.org (rogue)"; content:"|17|online-scanner-freelook|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freemap.org (rogue)"; content:"|16|online-scanner-freemap|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freemeet.org (rogue)"; content:"|17|online-scanner-freemeet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freesite.org (rogue)"; content:"|17|online-scanner-freesite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freetent.org (rogue)"; content:"|17|online-scanner-freetent|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freeu.org (rogue)"; content:"|14|online-scanner-freeu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-scanner-freevolt.org (rogue)"; content:"|17|online-scanner-freevolt|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinescannerfree.org (rogue)"; content:"|11|onlinescannerfree|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup orderav-scaner-online.org (rogue)"; content:"|15|orderav-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerav.net (rogue)"; content:"|07|powerav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pretection-page.org (rogue)"; content:"|0f|pretection-page|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protecmesages.org (rogue)"; content:"|0d|protecmesages|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-mesagess.org (rogue)"; content:"|10|protect-mesagess|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-mesage.org (rogue)"; content:"|11|protection-mesage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-messag.org (rogue)"; content:"|11|protection-messag|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection.equir.info (rogue)"; content:"|0a|protection|05|equir|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmesages.org (rogue)"; content:"|0e|protectmesages|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectmessages.org (rogue)"; content:"|0f|protectmessages|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickav.net (rogue)"; content:"|07|quickav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopav-online-scanner.org (rogue)"; content:"|15|shopav-online-scanner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-mesage.org (rogue)"; content:"|0a|sys-mesage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syssmessage.org (rogue)"; content:"|0b|syssmessage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysstem-mesage.org (rogue)"; content:"|0e|sysstem-mesage|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup system-message.org (rogue)"; content:"|0e|system-message|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wierx.in (Trojan )"; content:"|05|wierx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykttd.com (exploit)"; content:"|05|ykttd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 90000000.ru (exploit)"; content:"|08|90000000|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultxxxblog9.in (exploit)"; content:"|0d|adultxxxblog9|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agrovisiontool.info (exploit)"; content:"|0e|agrovisiontool|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajytse5.com (exploit)"; content:"|07|ajytse5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancspeciality.com (zeus)"; content:"|0d|ancspeciality|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arabesks.com (exploit)"; content:"|08|arabesks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurafinancialgroup.com (fastflux)"; content:"|12|aurafinancialgroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayelconsulting.net (zeus)"; content:"|0e|ayelconsulting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfotoson.com (backdoor)"; content:"|0b|bestfotoson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestpathsecurity.com (rogue)"; content:"|10|bestpathsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestversionantispyware.com (rogue)"; content:"|16|bestversionantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bettercontabil.com.br (zeus)"; content:"|0e|bettercontabil|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigcorpads.com (exploit)"; content:"|0a|bigcorpads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacksecuritygroup.com (rogue)"; content:"|12|blacksecuritygroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blanchi.fr (zeus)"; content:"|07|blanchi|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cabanalife.com (zeus)"; content:"|0a|cabanalife|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cechirecom.com (hack)"; content:"|0a|cechirecom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheburatorov.net (exploit)"; content:"|0c|cheburatorov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clandarkguide.info (fastflux)"; content:"|0d|clandarkguide|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickazio.com (rogue)"; content:"|09|clickazio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comsphut.com (rogue)"; content:"|08|comsphut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup connectdomainsrv.com (exploit)"; content:"|10|connectdomainsrv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup consejouna.com.ar (zeus)"; content:"|0a|consejouna|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup construtoranovak.com.br (zeus)"; content:"|10|construtoranovak|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolgirl.co.ohost.de (backdoor)"; content:"|08|coolgirl|02|co|05|ohost|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coralsantgregori.com (zeus)"; content:"|10|coralsantgregori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datacaps.com (rogue)"; content:"|08|datacaps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup debdo.in (exploit)"; content:"|05|debdo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defender-soft.com (rogue)"; content:"|0d|defender-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendersoftpremium.net (rogue)"; content:"|13|defendersoftpremium|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designfolkov.ru (backdoor)"; content:"|0c|designfolkov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dienstleistungen-am-haus.de (zeus)"; content:"|18|dienstleistungen-am-haus|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain274221.com (zeus)"; content:"|0c|domain274221|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eotegzua.com (fastflux)"; content:"|08|eotegzua|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equir.info (harmful)"; content:"|05|equir|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertugaluholu.com (rogue)"; content:"|0c|ertugaluholu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euvacant.com (moneymule)"; content:"|08|euvacant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faxmyreports.com (zeus)"; content:"|0c|faxmyreports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferring.php5.ayaco.ru (zeus)"; content:"|07|ferring|04|php5|05|ayaco|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findromance.com (fastflux)"; content:"|0b|findromance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fortress-software.net (rogue)"; content:"|11|fortress-software|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fpz.nl (zeus)"; content:"|03|fpz|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fretfly.com (rogue)"; content:"|07|fretfly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamedase.ru (bot)"; content:"|08|gamedase|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamedasr.ru (bot)"; content:"|08|gamedasr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamedast.ru (bot)"; content:"|08|gamedast|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gamedasy.ru (bot)"; content:"|08|gamedasy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genderswar.co.cc (zeus)"; content:"|0a|genderswar|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getsecuritydirect.com (rogue)"; content:"|11|getsecuritydirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grateinterrupt.ru (fastflux)"; content:"|0e|grateinterrupt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gretlfy.com (rogue)"; content:"|07|gretlfy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup growthpersonnel.net (malware)"; content:"|0f|growthpersonnel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grtefly.com (rogue)"; content:"|07|grtefly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harassdeceive.ru (fastflux)"; content:"|0d|harassdeceive|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hconsult.fr (zeus)"; content:"|08|hconsult|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holtzeffren.com.br (zeus)"; content:"|0b|holtzeffren|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hometeamfax.ru (malware)"; content:"|0b|hometeamfax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idekale.fr (zeus)"; content:"|07|idekale|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iditevcerkov.info (zeus)"; content:"|0c|iditevcerkov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup images4you-on.com (backdoor)"; content:"|0d|images4you-on|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inationalsecurity.com (rogue)"; content:"|11|inationalsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup integratesafety.com (zeus)"; content:"|0f|integratesafety|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetsecurityinside.com (rogue)"; content:"|16|internetsecurityinside|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iogoveof.com (fastflux)"; content:"|08|iogoveof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipv6i.tw (zeus)"; content:"|05|ipv6i|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jafidqai.com (fastflux)"; content:"|08|jafidqai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jooopount.com (rogue)"; content:"|09|jooopount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kdjkfjskdfjlskdjf.com (hack)"; content:"|11|kdjkfjskdfjlskdjf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keybussines.com (zeus)"; content:"|0b|keybussines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kino.vitk.net (zeus)"; content:"|04|kino|04|vitk|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klastf.ru (zeus)"; content:"|06|klastf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyxct.in (rogue)"; content:"|05|kyxct|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-pc-care2010.com (rogue)"; content:"|10|live-pc-care2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livepc-care2010.com (rogue)"; content:"|0f|livepc-care2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livepcantispyware.com (rogue)"; content:"|11|livepcantispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llllllllllllllllll.net (zeus)"; content:"|12|llllllllllllllllll|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lynnbreedlove.com (zeus)"; content:"|0d|lynnbreedlove|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup media76.pabumatrekurik.com (zeus)"; content:"|07|media76|0e|pabumatrekurik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mh-2.gnet.ba (zeus)"; content:"|04|mh-2|04|gnet|02|ba"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myicandy.com (rogue)"; content:"|08|myicandy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myperfection.ru (zeus)"; content:"|0c|myperfection|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationalsecurityorg.com (rogue)"; content:"|13|nationalsecurityorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nebuhai.com (c&c)"; content:"|07|nebuhai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neeidea.com (zeus)"; content:"|07|neeidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netsecurityonline.com (rogue)"; content:"|11|netsecurityonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networksecurityregistry.com (rogue)"; content:"|17|networksecurityregistry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newrus.su (zeus)"; content:"|06|newrus|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup one-care-antivirus2010.com (rogue)"; content:"|16|one-care-antivirus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p0k3r.eu (c&c)"; content:"|05|p0k3r|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pares.biz (zeus)"; content:"|05|pares|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pccareliveone.com (rogue)"; content:"|0d|pccareliveone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pclowcost.com (bot)"; content:"|09|pclowcost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pconguard.com (rogue)"; content:"|09|pconguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup player.hosting.paran.com (zeus)"; content:"|06|player|07|hosting|05|paran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pokesack.ru (fastflux)"; content:"|08|pokesack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup puma.behgar.com (malware)"; content:"|04|puma|06|behgar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysaecxa.eu (phishing)"; content:"|08|pysaecxa|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysaecxe.eu (phishing)"; content:"|08|pysaecxe|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysaecxi.eu (phishing)"; content:"|08|pysaecxi|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysaecxo.eu (phishing)"; content:"|08|pysaecxo|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pysaecxu.eu (phishing)"; content:"|08|pysaecxu|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raisfind.org (rogue)"; content:"|08|raisfind|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rebulkinc.com (zeus)"; content:"|09|rebulkinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retailsecurityguide.com (rogue)"; content:"|13|retailsecurityguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtlyh.in (rogue)"; content:"|05|rtlyh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russian-post.net (bot)"; content:"|0c|russian-post|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saipx.in (bot)"; content:"|05|saipx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sarahlamy-asvdanse.fr (zeus)"; content:"|12|sarahlamy-asvdanse|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savecompnow.com (hack)"; content:"|0b|savecompnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seclinezzz.tk (zeus)"; content:"|0a|seclinezzz|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seclzzz.biz (malware)"; content:"|07|seclzzz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.berque.info (malware)"; content:"|06|secure|06|berque|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-pccare2010.com (rogue)"; content:"|13|security-pccare2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityusaonline.com (rogue)"; content:"|11|securityusaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seyourimg.com (bot)"; content:"|09|seyourimg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sid57.tk (fastflux)"; content:"|05|sid57|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sktdo.com (c&c)"; content:"|05|sktdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smevault.com (rogue)"; content:"|08|smevault|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup software-defender.net (rogue)"; content:"|11|software-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacebuxer.com (zeus)"; content:"|0a|spacebuxer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sport.ro (malicious)"; content:"|05|sport|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep1.com (rogue)"; content:"|0e|spyware-sweep1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep1i.com (rogue)"; content:"|0f|spyware-sweep1i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep2i.com (rogue)"; content:"|0f|spyware-sweep2i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep3.com (rogue)"; content:"|0e|spyware-sweep3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep3i.com (rogue)"; content:"|0f|spyware-sweep3i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep4i.com (rogue)"; content:"|0f|spyware-sweep4i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep5.com (rogue)"; content:"|0e|spyware-sweep5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep7.com (rogue)"; content:"|0e|spyware-sweep7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep8.com (rogue)"; content:"|0e|spyware-sweep8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyware-sweep9i.com (rogue)"; content:"|0f|spyware-sweep9i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersunbeds.info (fastflux)"; content:"|0c|supersunbeds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superwebworld.info (malware)"; content:"|0d|superwebworld|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swpasaulis.com (zeus)"; content:"|0a|swpasaulis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup termasllifen.cl (zeus)"; content:"|0c|termasllifen|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theyellowsun.info (malicious)"; content:"|0c|theyellowsun|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup this-all-clean.com (malware)"; content:"|0e|this-all-clean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalsecuritydirect.com (rogue)"; content:"|13|totalsecuritydirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trashdomain.ru (bot)"; content:"|0b|trashdomain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v3rsus.eu (crimepack)"; content:"|06|v3rsus|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbccrhavvmr.com (malicious)"; content:"|0b|vbccrhavvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewinform.com (zeus)"; content:"|0a|viewinform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus021.com (rogue)"; content:"|10|web-antivirus021|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus022.com (rogue)"; content:"|10|web-antivirus022|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus023.com (rogue)"; content:"|10|web-antivirus023|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus025.com (rogue)"; content:"|10|web-antivirus025|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus035.com (rogue)"; content:"|10|web-antivirus035|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web-antivirus0z1.com (rogue)"; content:"|10|web-antivirus0z1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weinviertler-heuriger.at (zeus)"; content:"|15|weinviertler-heuriger|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wert-nation.com (zeus)"; content:"|0b|wert-nation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wsus-services.net (malicious)"; content:"|0d|wsus-services|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiaomiao.net (malicious)"; content:"|08|xiaomiao|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xorg.pl (threat)"; content:"|04|xorg|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xtubax.in (malware)"; content:"|06|xtubax|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmediadoctor.com (malware)"; content:"|0f|yourmediadoctor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecurityinfo.com (rogue)"; content:"|10|yoursecurityinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursecurityplus.com (rogue)"; content:"|10|yoursecurityplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zetross.com (zeus)"; content:"|07|zetross|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zmagazine.ru (zeus)"; content:"|09|zmagazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-reseach.com (malspam)"; content:"|0e|google-reseach|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0wners-team.com (threat)"; content:"|0b|0wners-team|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaszxy.ru (zeus)"; content:"|06|aaszxy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghmhikafir.com (mebroot)"; content:"|0b|aghmhikafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-soft.com (rogue)"; content:"|10|antispyware-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-live-one1.com (rogue)"; content:"|13|antivirus-live-one1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asafepc.com (rogue)"; content:"|07|asafepc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b-care.jp (zeus)"; content:"|06|b-care|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bart4simp.com (rogue)"; content:"|09|bart4simp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bartes2kot.com (rogue)"; content:"|0a|bartes2kot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigmaxmultimedia.com (malware)"; content:"|10|bigmaxmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bl.fcrazy.cc (malware)"; content:"|02|bl|06|fcrazy|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackflagvideo.com (malware)"; content:"|0e|blackflagvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bocatoma-hotel-resort.com (malware)"; content:"|15|bocatoma-hotel-resort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bradrichmond.com (malware)"; content:"|0c|bradrichmond|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bteldd.info (neosploit)"; content:"|06|bteldd|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buhniroma.com (malware)"; content:"|09|buhniroma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c00lphotos.com (malware)"; content:"|0a|c00lphotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7.qpdofz.net (malware)"; content:"|02|c7|06|qpdofz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centromarinocc.com (malware)"; content:"|0e|centromarinocc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chatalkhor.net (malware)"; content:"|0a|chatalkhor|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cn.wwvv.us (malware)"; content:"|02|cn|04|wwvv|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecardforyou.clanteam.com (malware)"; content:"|0b|ecardforyou|08|clanteam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup endroiturlredirect.com (exploits)"; content:"|12|endroiturlredirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epopx.in (malware)"; content:"|05|epopx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eromitres.com (malware)"; content:"|09|eromitres|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esero86.ru (malware)"; content:"|07|esero86|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etipx.in (malware)"; content:"|05|etipx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expensiveimages.com (malware)"; content:"|0f|expensiveimages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmmediastar.com (malware)"; content:"|0d|filmmediastar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmutiliteonline.com (malware)"; content:"|11|filmutiliteonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderrac.org (malware)"; content:"|09|finderrac|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flvfilm.com (malware)"; content:"|07|flvfilm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foinkto015.net (malware)"; content:"|0a|foinkto015|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fondospara.com (malware)"; content:"|0a|fondospara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotos-hahah.com (malware)"; content:"|0b|fotos-hahah|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hochux6.info (neosploit)"; content:"|07|hochux6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup images.0len.in (neosploit)"; content:"|06|images|04|0len|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup images.0lis.in (neosploit)"; content:"|06|images|04|0lis|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-checker-free.com (exploits)"; content:"|14|malware-checker-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mdn-design.info (malware)"; content:"|0a|mdn-design|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medialinknews.com (malware)"; content:"|0d|medialinknews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megga.ru (zeus)"; content:"|05|megga|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micro.zymichost.com (malware)"; content:"|05|micro|09|zymichost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mingrichun.com (malware)"; content:"|0a|mingrichun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movie.c1umb.in (neosploit)"; content:"|05|movie|05|c1umb|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviemediastar.com (malware)"; content:"|0e|moviemediastar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mscps.in (malware)"; content:"|05|mscps|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-id.freehosting.com (malware)"; content:"|06|msn-id|0b|freehosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn.bigprofile.com (malware)"; content:"|03|msn|0a|bigprofile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msvideosoft.com (malware)"; content:"|0b|msvideosoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mufolis.com (malware)"; content:"|07|mufolis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myfreeutilities.com (malware)"; content:"|0f|myfreeutilities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myxvideodump.com (malware)"; content:"|0c|myxvideodump|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nationalmedecine.com (rfi)"; content:"|10|nationalmedecine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nature2energy.com (malware)"; content:"|0d|nature2energy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ndpwrgg.info (neosploit)"; content:"|07|ndpwrgg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup necoshop.com (malware)"; content:"|08|necoshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nopagency.com (malware)"; content:"|09|nopagency|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oft.ag (malware)"; content:"|03|oft|02|ag"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-b92.com (malware)"; content:"|0a|online-b92|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onotole777.ru (malware)"; content:"|0a|onotole777|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oophohyoshiige2aceeth4fu.com (malware)"; content:"|18|oophohyoshiige2aceeth4fu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oroboros.in (threat)"; content:"|08|oroboros|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup picturesoftglue.com (malware)"; content:"|0f|picturesoftglue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plexco.co.cc (malware)"; content:"|06|plexco|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poceka.info (neosploit)"; content:"|06|poceka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popoloruty.in (malware)"; content:"|0a|popoloruty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ppp3ppp.biz (malware)"; content:"|07|ppp3ppp|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqdevjwznyw.com (mebroot)"; content:"|0b|pqdevjwznyw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup publicidadendurango.com (malware)"; content:"|13|publicidadendurango|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmediacenter.com (malware)"; content:"|0f|realmediacenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup somegreatsongs.com (threat)"; content:"|0e|somegreatsongs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space4images.info (malware)"; content:"|0c|space4images|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spaceforfotos.com (malware)"; content:"|0d|spaceforfotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sragenkab.go.id (malware)"; content:"|09|sragenkab|02|go|02|id"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streamingsports.altervista.org (malware)"; content:"|0f|streamingsports|0a|altervista|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumk.in (malware)"; content:"|04|sumk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superdogmedia.com (malware)"; content:"|0d|superdogmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supertubevideos.com (malware)"; content:"|0f|supertubevideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemcheck.x10hosting.com (malware)"; content:"|0b|systemcheck|0a|x10hosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagged-facebook.com (malware)"; content:"|0f|tagged-facebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theloaddata.com (malware)"; content:"|0b|theloaddata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetube4you.info (malware)"; content:"|0b|thetube4you|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tolstiy.co.cc (exploits)"; content:"|07|tolstiy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trimlifemedia.com (malware)"; content:"|0d|trimlifemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tripnet.com (malware)"; content:"|07|tripnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umbjoobes.com (malware)"; content:"|09|umbjoobes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unloooted.com (malware)"; content:"|09|unloooted|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utilitiesstorage.com (malware)"; content:"|10|utilitiesstorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vasyadurak.ru (malware)"; content:"|0a|vasyadurak|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoholland.nl (malware)"; content:"|0c|videoholland|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videosofttools.com (malware)"; content:"|0e|videosofttools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidoo2ri.in (malware)"; content:"|08|vidoo2ri|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vimakina.com (malware)"; content:"|08|vimakina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vip-space.net (malware)"; content:"|09|vip-space|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xtmhltmxaacg.com (mebroot)"; content:"|0c|xtmhltmxaacg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zavalis.info (neosploit)"; content:"|07|zavalis|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anal-toy.org (malware)"; content:"|08|anal-toy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.official-emule.com (malware)"; content:"|08|download|0e|official-emule|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.z5x.net (malvert)"; content:"|02|ad|03|z5x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azsbwkwwwxvf.com (neosploit)"; content:"|0c|azsbwkwwwxvf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benefit-sales.com (fraud)"; content:"|0d|benefit-sales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birbins-of.com (exploit)"; content:"|0a|birbins-of|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobleblack.com (fraud)"; content:"|0a|bobleblack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobleboble.com (fraud)"; content:"|0a|bobleboble|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boblebreak.com (fraud)"; content:"|0a|boblebreak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buy-download.net (fraud)"; content:"|0c|buy-download|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheap-market.com (fraud)"; content:"|0c|cheap-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cialisviagrabest.com (fraud)"; content:"|10|cialisviagrabest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ciro062.hpg.com.br (malware)"; content:"|07|ciro062|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanupantivirus.com (exploit)"; content:"|10|cleanupantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clothedown.com (phishing)"; content:"|0a|clothedown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup createpc-pcscan-korn.net (exploit)"; content:"|14|createpc-pcscan-korn|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crimepayz.biz (malware)"; content:"|09|crimepayz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup det0xcorp.kz (threat)"; content:"|09|det0xcorp|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondgoals.com (fraud)"; content:"|0c|diamondgoals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dinamite-deal.com (fraud)"; content:"|0d|dinamite-deal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dodtorsans.net (exploit)"; content:"|0a|dodtorsans|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety60-pd.net (rogue)"; content:"|10|doforsafety60-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety61-pd.net (rogue)"; content:"|10|doforsafety61-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety62-pd.net (rogue)"; content:"|10|doforsafety62-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety63-pd.net (rogue)"; content:"|10|doforsafety63-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety64-pd.net (rogue)"; content:"|10|doforsafety64-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety65-pd.net (rogue)"; content:"|10|doforsafety65-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety66-pd.net (rogue)"; content:"|10|doforsafety66-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety67-pd.net (rogue)"; content:"|10|doforsafety67-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety68-pd.net (rogue)"; content:"|10|doforsafety68-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doforsafety69-pd.net (rogue)"; content:"|10|doforsafety69-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyas123abcandfu.com (fastflux)"; content:"|11|easyas123abcandfu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enlarge-mypenis.com (fraud)"; content:"|0f|enlarge-mypenis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fhio22nd.net (exploit)"; content:"|08|fhio22nd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightmalware7.com (malware)"; content:"|0d|fightmalware7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard40-pd.com (rogue)"; content:"|10|finestguard40-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard40-pd.net (rogue)"; content:"|10|finestguard40-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard41-pd.com (rogue)"; content:"|10|finestguard41-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard41-pd.net (rogue)"; content:"|10|finestguard41-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard42-pd.com (rogue)"; content:"|10|finestguard42-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard42-pd.net (rogue)"; content:"|10|finestguard42-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard43-pd.com (rogue)"; content:"|10|finestguard43-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard43-pd.net (rogue)"; content:"|10|finestguard43-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard44-pd.com (rogue)"; content:"|10|finestguard44-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard44-pd.net (rogue)"; content:"|10|finestguard44-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard45-pd.com (rogue)"; content:"|10|finestguard45-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard45-pd.net (rogue)"; content:"|10|finestguard45-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard46-pd.com (rogue)"; content:"|10|finestguard46-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard46-pd.net (rogue)"; content:"|10|finestguard46-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard47-pd.com (rogue)"; content:"|10|finestguard47-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard48-pd.com (rogue)"; content:"|10|finestguard48-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard48-pd.net (rogue)"; content:"|10|finestguard48-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard49-pd.com (rogue)"; content:"|10|finestguard49-pd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finestguard49-pd.net (rogue)"; content:"|10|finestguard49-pd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gallerysbest.com (fraud)"; content:"|0c|gallerysbest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginopost.com (exploit)"; content:"|08|ginopost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-searchandscan.net (exploit)"; content:"|10|go-searchandscan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatestdeasl.com (fraud)"; content:"|0d|greatestdeasl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grepad.com (exploit)"; content:"|06|grepad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happyplanet.com.mx (malspam)"; content:"|0b|happyplanet|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup health-life-co.com (fastflux)"; content:"|0e|health-life-co|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup health-online-com.com (fastflux)"; content:"|11|health-online-com|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgaragesales.net (fastflux)"; content:"|0c|hgaragesales|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homesatmadison.com (fastflux)"; content:"|0e|homesatmadison|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot-cleanofyourpc.com (exploit)"; content:"|11|hot-cleanofyourpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ileon.us (exploit)"; content:"|05|ileon|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup impish.info (threat)"; content:"|06|impish|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jademason.com (fastflux)"; content:"|09|jademason|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javapony.org (exploit)"; content:"|08|javapony|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letme-guardyourzone.com (exploit)"; content:"|13|letme-guardyourzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup letprotectsystem.net (exploit)"; content:"|10|letprotectsystem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup life-health-co.com (fastflux)"; content:"|0e|life-health-co|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup light-brands.com (fraud)"; content:"|0c|light-brands|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loseheavyweights.com (fraud)"; content:"|10|loseheavyweights|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madisoninc.net (fastflux)"; content:"|0a|madisoninc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malware-checker-free.net (harmful)"; content:"|14|malware-checker-free|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mannyorder.com (fraud)"; content:"|0a|mannyorder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marfilks.net (exploit)"; content:"|08|marfilks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marmarams.com (exploit)"; content:"|09|marmarams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masterglass.go.ro (harmful)"; content:"|0b|masterglass|02|go|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-softprotect4.net (exploit)"; content:"|0f|my-softprotect4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-systemprotection.net (exploit)"; content:"|13|my-systemprotection|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-test-domain.ru (exploit)"; content:"|0e|my-test-domain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotected-system.com (exploit)"; content:"|12|myprotected-system|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsystem-guard.com (exploit)"; content:"|0f|newsystem-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oem-buy-software.com (fraud)"; content:"|10|oem-buy-software|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oem-buy-software.net (fraud)"; content:"|10|oem-buy-software|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup on-discount.com (fraud)"; content:"|0b|on-discount|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onguard-zone.net (exploit)"; content:"|0c|onguard-zone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-soft.net (fraud)"; content:"|0b|online-soft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesstop.com (fraud)"; content:"|0b|onlinesstop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup payment-safety.net (exploit)"; content:"|0e|payment-safety|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcregrtuy.net (exploit)"; content:"|09|pcregrtuy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectstorez.com (fraud)"; content:"|0d|perfectstorez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pert45s.com (exploit)"; content:"|07|pert45s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plotguardto-mypc.com (exploit)"; content:"|10|plotguardto-mypc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-movies-26c96.com (Trojan )"; content:"|11|porn-movies-26c96|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup questionhere.com (fraud)"; content:"|0c|questionhere|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raskeni.ru (zeus)"; content:"|07|raskeni|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realguardforyou20p.net (rogue)"; content:"|12|realguardforyou20p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realguardforyou21p.net (rogue)"; content:"|12|realguardforyou21p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realguardforyou22p.net (rogue)"; content:"|12|realguardforyou22p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realguardforyou23p.net (rogue)"; content:"|12|realguardforyou23p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realguardforyou24p.net (rogue)"; content:"|12|realguardforyou24p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recover88888.com (zbot)"; content:"|0c|recover88888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup requiregift.com (fraud)"; content:"|0b|requiregift|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romsinkord.com (exploit)"; content:"|0a|romsinkord|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundboble.com (fraud)"; content:"|0a|roundboble|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundclever.com (fraud)"; content:"|0b|roundclever|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundopen.com (fraud)"; content:"|09|roundopen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundrunning.com (fraud)"; content:"|0c|roundrunning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safelinkhere.net (exploit)"; content:"|0c|safelinkhere|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salon-de-miki.jp (zeus)"; content:"|0d|salon-de-miki|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save-secure.com (exploit)"; content:"|0b|save-secure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup screenroad.com (fraud)"; content:"|0a|screenroad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search4vir.net (exploit)"; content:"|0a|search4vir|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharifabadco.com (harmful)"; content:"|0c|sharifabadco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-gods.com (fraud)"; content:"|09|shop-gods|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-here-now.com (fraud)"; content:"|0d|shop-here-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snowgrid.com (fraud)"; content:"|08|snowgrid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startisland.com (malware)"; content:"|0b|startisland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase50td.com (rogue)"; content:"|0c|suitcase50td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase50td.net (rogue)"; content:"|0c|suitcase50td|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase51td.com (rogue)"; content:"|0c|suitcase51td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase51td.net (rogue)"; content:"|0c|suitcase51td|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase52td.com (rogue)"; content:"|0c|suitcase52td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase52td.net (rogue)"; content:"|0c|suitcase52td|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase53td.com (rogue)"; content:"|0c|suitcase53td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase53td.net (rogue)"; content:"|0c|suitcase53td|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase54td.com (rogue)"; content:"|0c|suitcase54td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suitcase54td.net (rogue)"; content:"|0c|suitcase54td|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superwidgetcomponents.info (neosploit)"; content:"|15|superwidgetcomponents|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemcec7.com (exploit)"; content:"|0a|systemcec7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teperb-bananoviy.com (fastflux)"; content:"|10|teperb-bananoviy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave1.com (rogue)"; content:"|09|terasave1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave10.com (rogue)"; content:"|0a|terasave10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave11.com (rogue)"; content:"|0a|terasave11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave12.com (rogue)"; content:"|0a|terasave12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave2.com (rogue)"; content:"|09|terasave2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave3.com (rogue)"; content:"|09|terasave3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave4.com (rogue)"; content:"|09|terasave4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave5.com (rogue)"; content:"|09|terasave5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave6.com (rogue)"; content:"|09|terasave6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave7.com (rogue)"; content:"|09|terasave7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave8.com (rogue)"; content:"|09|terasave8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terasave9.com (rogue)"; content:"|09|terasave9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thejustb.com (exploit)"; content:"|08|thejustb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetrinity.com.tw (malware)"; content:"|0a|thetrinity|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treatsudden.com (malware)"; content:"|0b|treatsudden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trust-systemprotect.net (exploit)"; content:"|13|trust-systemprotect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustsystemguard.net (exploit)"; content:"|10|trustsystemguard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updates-account.net (phishing)"; content:"|0f|updates-account|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upscanyour-pcnow.com (exploit)"; content:"|10|upscanyour-pcnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upscanyourpc-now.com (exploit)"; content:"|10|upscanyourpc-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upwin.co.cc (trojan)"; content:"|05|upwin|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vilkgood.cn (zeus)"; content:"|08|vilkgood|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volunteerabroad.ca (trojan)"; content:"|0f|volunteerabroad|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vyyy-team.cs.nov.ru (malspam)"; content:"|09|vyyy-team|02|cs|03|nov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windows-systemshield.net (exploit)"; content:"|14|windows-systemshield|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxxxx000.net (fastflux)"; content:"|09|xxxxxx000|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e37z.cn (trojan)"; content:"|04|e37z|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-online-scanv3.com (malware)"; content:"|19|antimalware-online-scanv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywhoisinfo.com (malware)"; content:"|0b|mywhoisinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameclaimstore.cn (malware)"; content:"|0e|nameclaimstore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameforshop.cn (malware)"; content:"|0b|nameforshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namemartfilm.cn (malware)"; content:"|0c|namemartfilm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup namestorevideo.cn (malware)"; content:"|0e|namestorevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonfathighestlocate.cn (malware)"; content:"|13|nonfathighestlocate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwareonlinescannerv3.com (malware)"; content:"|1a|antimalwareonlinescannerv3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareprotectiontoolcom.com (malware)"; content:"|1c|antispywareprotectiontoolcom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytae.com (harmful)"; content:"|0f|google-analytae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytlcs.com (harmful)"; content:"|10|google-analytlcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleanalytics.cn (malware)"; content:"|0f|googleanalytics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleanalytlcs.net (malware)"; content:"|0f|googleanalytlcs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatliteautobest.cn (harmful)"; content:"|11|greatliteautobest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-soft.com (malware)"; content:"|0c|antivir-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malwareremovebot.com (rogue)"; content:"|10|malwareremovebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millionsdream.cn (malware)"; content:"|0d|millionsdream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus09.net (malware)"; content:"|0b|antivirus09|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusnano.com (malware)"; content:"|0d|antivirusnano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 021http.com (malware)"; content:"|07|021http|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12388.info (malware)"; content:"|05|12388|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 22bin.com.pl (trojan)"; content:"|05|22bin|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2moro.fr (trojan)"; content:"|05|2moro|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 32094820349.com (malware)"; content:"|0b|32094820349|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 919l.com (malware)"; content:"|04|919l|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-fast.com (rogue)"; content:"|06|a-fast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2c.it (zeus)"; content:"|03|a2c|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaronpreciado.com (trojan)"; content:"|0d|aaronpreciado|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup about-bear.com (exploit)"; content:"|0a|about-bear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acde.xicp.cn (trojan)"; content:"|04|acde|04|xicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acpbdf.com.br (backdoor)"; content:"|06|acpbdf|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activcomfrance.com (malware)"; content:"|0e|activcomfrance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adcampodecambui.com.br (backdoor)"; content:"|0f|adcampodecambui|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin.anacli.co.kr (malware)"; content:"|05|admin|06|anacli|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajitkkravmr.com (malware)"; content:"|0b|ajitkkravmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajudasonline.info (trojan)"; content:"|0c|ajudasonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alf.inf.br (exploit)"; content:"|03|alf|03|inf|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfreecash.net (trojan)"; content:"|0b|allfreecash|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnettraf.com (exploit)"; content:"|0a|allnettraf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amandaxporn.com (malware)"; content:"|0b|amandaxporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angolotesti.it (iframe)"; content:"|0b|angolotesti|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankefristth.com (exploit)"; content:"|0b|ankefristth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispamerteam.com (malware)"; content:"|0e|antispamerteam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusys.ru (malware)"; content:"|0b|antivirusys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquirecosmeticos.com.br (trojan)"; content:"|10|aquirecosmeticos|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aristeo.info (malware)"; content:"|07|aristeo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arturfiles677.name (zeus)"; content:"|0d|arturfiles677|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup astro.pl (malware)"; content:"|05|astro|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aubuy2do.com (malware)"; content:"|08|aubuy2do|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av.lometr.pl (malware)"; content:"|02|av|06|lometr|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baronmakaron.net (malware)"; content:"|0c|baronmakaron|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup base-antispyware.com (rogue)"; content:"|10|base-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup belleplaceurl.com (exploit)"; content:"|0d|belleplaceurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beste-onlinespiele.com (trojan)"; content:"|12|beste-onlinespiele|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigassgames.com (trojan)"; content:"|0b|bigassgames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biooer.net (exploit)"; content:"|06|biooer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogsofts.com (trojan)"; content:"|09|blogsofts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmw-pad.com (trojan)"; content:"|07|bmw-pad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buffingtonlaw.com (trojan)"; content:"|0d|buffingtonlaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buspacket.com (exploit)"; content:"|09|buspacket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centurioxrest.info (malware)"; content:"|0d|centurioxrest|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup certificadosdigitais.org (trojan)"; content:"|14|certificadosdigitais|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfelinosbrasil.org (trojan)"; content:"|0e|cfelinosbrasil|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup checkrapport.com (exploit)"; content:"|0c|checkrapport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup christophecoinurl.com (exploit)"; content:"|11|christophecoinurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coinurlredirect.com (exploit)"; content:"|0f|coinurlredirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coinurlredirection.com (exploit)"; content:"|12|coinurlredirection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coloritym0.info (zeus)"; content:"|0a|coloritym0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commerceclick.co.uk (malicious)"; content:"|0d|commerceclick|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core2637.instituteofbianco.com (rogue)"; content:"|08|core2637|11|instituteofbianco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup def.ignorelist.com (neosploit)"; content:"|03|def|0a|ignorelist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defencelab.com (rogue)"; content:"|0a|defencelab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defibonyx12.co.cc (zeus)"; content:"|0b|defibonyx12|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defibrilator-life.co.cc (zeus)"; content:"|11|defibrilator-life|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dirtysin.ru (malware)"; content:"|08|dirtysin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dns-look-up.com (malware)"; content:"|0b|dns-look-up|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain231118.com (exploit)"; content:"|0c|domain231118|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dopsirr.info (trojan)"; content:"|07|dopsirr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down-south.com (iframe)"; content:"|0a|down-south|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download.mandeibem.com.br (trojan)"; content:"|08|download|09|mandeibem|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drug-onlinestore.com (malspam)"; content:"|10|drug-onlinestore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edisson-light.co.cc (zeus)"; content:"|0d|edisson-light|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eidolonax69.com (malware)"; content:"|0b|eidolonax69|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elara-m.ru (trojan)"; content:"|07|elara-m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elesssnet.net (exploit)"; content:"|09|elesssnet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elpsw.in (exploit)"; content:"|05|elpsw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epsea.in (exploit)"; content:"|05|epsea|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup estortetotal.hpg.com.br (trojan)"; content:"|0c|estortetotal|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fatqa.6600.org (exploit)"; content:"|05|fatqa|04|6600|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findercrs.org (rogue)"; content:"|09|findercrs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderdow.org (rogue)"; content:"|09|finderdow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firesavez5.com (exploit)"; content:"|0a|firesavez5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foresx.co.cc (exploit)"; content:"|06|foresx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotosgyn.pessoal.ws (trojan)"; content:"|08|fotosgyn|07|pessoal|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fullfreepoker.com (iframe)"; content:"|0d|fullfreepoker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxeurostar.org (iframe)"; content:"|0a|fxeurostar|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gmcstar.com (-)"; content:"|07|gmcstar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogomt.biz (exploit)"; content:"|06|gogomt|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldcoinurl.com (exploit)"; content:"|0b|goldcoinurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hao123.com.wwvv.us (exploit)"; content:"|06|hao123|03|com|04|wwvv|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homosrus.com (iframe)"; content:"|08|homosrus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup host-domain-lookup.com (malware)"; content:"|12|host-domain-lookup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotelplaceurl.com (exploit)"; content:"|0d|hotelplaceurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugeadsorg.com (exploit)"; content:"|0a|hugeadsorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvcvjxcc.cn (exploit)"; content:"|08|hvcvjxcc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indesignstudioinfo.com (exploit)"; content:"|12|indesignstudioinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instituteofbianco.com (rogue)"; content:"|11|instituteofbianco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intercinema.ru (trojan)"; content:"|0b|intercinema|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipmpcolv.com (trojan)"; content:"|08|ipmpcolv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iswai.in (exploit)"; content:"|05|iswai|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhrez76.com (exploit)"; content:"|07|jhrez76|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joy-adventure.ru (rogue)"; content:"|0d|joy-adventure|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolpredv.com (risk)"; content:"|08|kolpredv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kranenborg.info (trojan)"; content:"|0a|kranenborg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kulk.in (exploit)"; content:"|04|kulk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kwekalu.net (iframe)"; content:"|07|kwekalu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kysavas.com (zeus)"; content:"|07|kysavas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lasur8e.com (exploit)"; content:"|07|lasur8e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legeni.biz (exploit)"; content:"|06|legeni|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lieuurlredirect.com (exploit)"; content:"|0f|lieuurlredirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lpozz.com (zeus)"; content:"|05|lpozz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lutypla.com (malspam)"; content:"|07|lutypla|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makievleri.com (zeus)"; content:"|0a|makievleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mazatrafa2.ru (exploit)"; content:"|0a|mazatrafa2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediastatsfx.com (malware)"; content:"|0c|mediastatsfx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meifawu.com (malware)"; content:"|07|meifawu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mercopecasauto.com.br (trojan)"; content:"|0e|mercopecasauto|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mhzx8.com (trojan)"; content:"|05|mhzx8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mngh54.6600.org (trojan)"; content:"|06|mngh54|04|6600|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnuyetsgrr.com (exploit)"; content:"|0a|mnuyetsgrr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moves.vaiosys.com (ircbot)"; content:"|05|moves|07|vaiosys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutant-star.net (c&c)"; content:"|0b|mutant-star|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my318.info (trojan)"; content:"|05|my318|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my654bestsite.com (exploit)"; content:"|0d|my654bestsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypxn.in (exploit)"; content:"|05|mypxn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanodrivetools.net (exploit)"; content:"|0e|nanodrivetools|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nebwsy.com (zeus)"; content:"|06|nebwsy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup negtsload.com (trojan)"; content:"|09|negtsload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-crash.com (exploit)"; content:"|09|new-crash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-pc-protection.com (exploit)"; content:"|11|new-pc-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ofruv.com (zeus)"; content:"|05|ofruv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onelead.ru (malware)"; content:"|07|onelead|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineshopgo.com (malware)"; content:"|0c|onlineshopgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onrename.com (rogue)"; content:"|08|onrename|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourautism.com (iframe)"; content:"|09|ourautism|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourdope.ru (malware)"; content:"|07|ourdope|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pandavideos4u.com (trojan)"; content:"|0d|pandavideos4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parisfesta.hpg.com.br (trojan)"; content:"|0a|parisfesta|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkplaceurl.com (exploit)"; content:"|0c|parkplaceurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partenaires-particuliers.fr (koobface)"; content:"|18|partenaires-particuliers|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup passportblues.ru (malware)"; content:"|0d|passportblues|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pic.starsarabian.com (iframe)"; content:"|03|pic|0c|starsarabian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillsmartshop.com (malspam)"; content:"|0d|pillsmartshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pimpcollv.com (trojan)"; content:"|09|pimpcollv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pimpocolv.com (trojan)"; content:"|09|pimpocolv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pipmcolv.com (trojan)"; content:"|08|pipmcolv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playzoneonline.at (exploit)"; content:"|0e|playzoneonline|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup politicalwrap.com (zeus)"; content:"|0d|politicalwrap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polkita.com (malspam)"; content:"|07|polkita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polubomucom.com (exploit)"; content:"|0b|polubomucom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumporndump.com (trojan)"; content:"|0f|premiumporndump|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privatefucking.net (exploit)"; content:"|0e|privatefucking|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qw.acde.xicp.cn (trojan)"; content:"|02|qw|04|acde|04|xicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qwebork.com (malspam)"; content:"|07|qwebork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup range159-195.com (malware)"; content:"|0c|range159-195|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup real-unix.com (zeus)"; content:"|09|real-unix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reddkecm.cn (exploit)"; content:"|08|reddkecm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relwqin.com (malspam)"; content:"|07|relwqin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reportes201.com (trojan)"; content:"|0b|reportes201|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtmps.in (exploit)"; content:"|05|rtmps|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safety.corna.com (trojan)"; content:"|06|safety|05|corna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safetypayments.net (exploit)"; content:"|0e|safetypayments|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salamandainword.ru (zeus)"; content:"|0f|salamandainword|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandboix.com (trojan)"; content:"|08|sandboix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchgeten.org (malware)"; content:"|0b|searchgeten|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selecbizdom.com (zeus)"; content:"|0b|selecbizdom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexypypsik.ru (zeus)"; content:"|0a|sexypypsik|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shd3h80nd348dhn348f34hinom9io.com (zeus)"; content:"|1d|shd3h80nd348dhn348f34hinom9io|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shletz.co.cc (trojan)"; content:"|06|shletz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silvercoinurl.com (exploit)"; content:"|0d|silvercoinurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snypz.com (trojan)"; content:"|05|snypz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sociedadebc.hpg.com.br (trojan)"; content:"|0b|sociedadebc|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sofotosx.front.ru (trojan)"; content:"|08|sofotosx|05|front|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorentobus.com (exploit)"; content:"|0a|sorentobus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-defender.com (rogue)"; content:"|0c|sys-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-defender.net (rogue)"; content:"|0c|sys-defender|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t8tt.cn (malware)"; content:"|04|t8tt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetoyzone.com (iframe)"; content:"|0a|thetoyzone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trelomna.com (malicious)"; content:"|08|trelomna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustandgoinc.com (exploit)"; content:"|0d|trustandgoinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tryfidojfox.com (exploit)"; content:"|0b|tryfidojfox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trynger.com (malspam)"; content:"|07|trynger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turkinke.com (malspam)"; content:"|08|turkinke|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typfelt.com (trojan)"; content:"|07|typfelt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup union.1149.cn (malware)"; content:"|05|union|04|1149|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unwited.com (malicious)"; content:"|07|unwited|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidzone.mooo.com (trojan)"; content:"|07|vidzone|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voonixs99.com (zeus)"; content:"|09|voonixs99|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvv01.in (trojan)"; content:"|05|vvv01|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warp86.com (trojan)"; content:"|06|warp86|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web117.com (trojan)"; content:"|06|web117|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgetcool.com (rogue)"; content:"|0a|webgetcool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmasterbloog.com (trojan)"; content:"|0e|webmasterbloog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup widno.in (exploit)"; content:"|05|widno|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldplaceurl.com (exploit)"; content:"|0d|worldplaceurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldsstatistics.co.cc (zeus)"; content:"|10|worldsstatistics|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xalentarna.net (exploit)"; content:"|0a|xalentarna|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhostcoderx.hpg.com.br (trojan)"; content:"|0b|xhostcoderx|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup y445.com (trojan)"; content:"|04|y445|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yo1688.com (trojan)"; content:"|06|yo1688|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup your-up-search.net (zeus)"; content:"|0e|your-up-search|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytza.net (trojan)"; content:"|04|ytza|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z137009.infobox.ru (zeus)"; content:"|07|z137009|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zarenaga.com (malspam)"; content:"|08|zarenaga|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zettapetta.com (exploit)"; content:"|0a|zettapetta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 411online-scanner-free.com (rogue )"; content:"|16|411online-scanner-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aa118.uicp.cn (malicious)"; content:"|05|aa118|04|uicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anivirusesscaner.com (rogue )"; content:"|10|anivirusesscaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyprog.com (rogue)"; content:"|0b|antispyprog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyprog.net (rogue)"; content:"|0b|antispyprog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispysolution.com (rogue)"; content:"|0f|antispysolution|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispysolution.net (rogue)"; content:"|0f|antispysolution|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywarelist.com (malware)"; content:"|0f|antispywarelist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviral-plus.com (rogue)"; content:"|0e|antiviral-plus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviral-pluss.com (rogue)"; content:"|0f|antiviral-pluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviralpluss.com (rogue)"; content:"|0e|antiviralpluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirs-pluss.com (rogue)"; content:"|0e|antivirs-pluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirspluss.com (rogue)"; content:"|0d|antivirspluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviru-pluss.com (rogue)"; content:"|0e|antiviru-pluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirupluss.com (rogue)"; content:"|0d|antivirupluss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-p1uss.com (rogue)"; content:"|0f|antivirus-p1uss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aoqexjac.com (fraud)"; content:"|08|aoqexjac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ativirpluscanerr.com (rogue )"; content:"|10|ativirpluscanerr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ativirplusscanerr.com (rogue )"; content:"|11|ativirplusscanerr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-onlicity.com (rogue )"; content:"|0b|av-onlicity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scanner.com (rogue )"; content:"|11|av-online-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerbid.com (rogue )"; content:"|14|av-online-scannerbid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannercrest.com (rogue )"; content:"|16|av-online-scannercrest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerfolk.com (rogue )"; content:"|15|av-online-scannerfolk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannergate.com (rogue )"; content:"|15|av-online-scannergate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerland.com (rogue )"; content:"|15|av-online-scannerland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerpc.com (rogue )"; content:"|13|av-online-scannerpc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannersite.com (rogue )"; content:"|15|av-online-scannersite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerweek.com (rogue )"; content:"|15|av-online-scannerweek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-online-scannerwing.com (rogue )"; content:"|15|av-online-scannerwing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-onlinescanner.com (rogue )"; content:"|10|av-onlinescanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scanally.com (rogue )"; content:"|0b|av-scanally|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-online.com (rogue )"; content:"|10|av-scaner-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-online3k.com (rogue )"; content:"|12|av-scaner-online3k|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineband.com (rogue )"; content:"|14|av-scaner-onlineband|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinebody.com (rogue )"; content:"|14|av-scaner-onlinebody|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinebuzz.com (rogue )"; content:"|14|av-scaner-onlinebuzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinecabin.com (rogue )"; content:"|15|av-scaner-onlinecabin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinecrest.com (rogue )"; content:"|15|av-scaner-onlinecrest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinefairy.com (rogue )"; content:"|15|av-scaner-onlinefairy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinefolk.com (rogue )"; content:"|14|av-scaner-onlinefolk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinegrinder.com (rogue )"; content:"|17|av-scaner-onlinegrinder|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinehistory.com (rogue )"; content:"|17|av-scaner-onlinehistory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineicity.com (rogue )"; content:"|15|av-scaner-onlineicity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinemachine.com (rogue )"; content:"|17|av-scaner-onlinemachine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinepeople.com (rogue )"; content:"|16|av-scaner-onlinepeople|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineplan.com (rogue )"; content:"|14|av-scaner-onlineplan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlineretort.com (rogue )"; content:"|16|av-scaner-onlineretort|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinereview.com (rogue )"; content:"|16|av-scaner-onlinereview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinesite.com (rogue )"; content:"|14|av-scaner-onlinesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-scaner-onlinetopia.com (rogue )"; content:"|15|av-scaner-onlinetopia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azrsa.in (malware)"; content:"|05|azrsa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bdmlr.org.uk (malware)"; content:"|05|bdmlr|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beseyriu.com (fraud)"; content:"|08|beseyriu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-soft-free.com (malware)"; content:"|0e|best-soft-free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfilmaround.com (malware)"; content:"|0e|bestfilmaround|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besthorny-tube.org (malware)"; content:"|0e|besthorny-tube|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmediastorage.com (malware)"; content:"|10|bestmediastorage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmoviesource.com (malware)"; content:"|0f|bestmoviesource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigdatavault.com (malware)"; content:"|0c|bigdatavault|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biomed.name (malware)"; content:"|06|biomed|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bosinsuv.com (fraud)"; content:"|08|bosinsuv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightspottech.com (malware)"; content:"|0e|brightspottech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caketops.it (threat)"; content:"|08|caketops|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cariport.com (malware)"; content:"|08|cariport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup climersnet.com (malware)"; content:"|0a|climersnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cnbnews.com (malware)"; content:"|07|cnbnews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comadssearch.org (malware)"; content:"|0c|comadssearch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conflictingviews.com (malware)"; content:"|10|conflictingviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup controbass.org (malware)"; content:"|0a|controbass|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cool-pornovideos.com (trojan)"; content:"|10|cool-pornovideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cpmenhqdlx.co.cc (malware)"; content:"|0a|cpmenhqdlx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cudjoehouse.com (malware)"; content:"|0b|cudjoehouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup culturemediaonline.com (malware)"; content:"|12|culturemediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyberduck.ru (exploitkit )"; content:"|09|cyberduck|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d8vod.com (malware)"; content:"|05|d8vod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demiliawes.com (malware)"; content:"|0a|demiliawes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dep.lt (harmful)"; content:"|03|dep|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depclub.ru (malware)"; content:"|07|depclub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deswaux.com (exploit)"; content:"|07|deswaux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalmastermark.com (malware)"; content:"|11|digitalmastermark|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dipli.unipa.it (malware)"; content:"|05|dipli|05|unipa|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkmjfm.info (malware)"; content:"|06|dkmjfm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doeoxsit.com (fraud)"; content:"|08|doeoxsit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easy-ns-server.org (rogue )"; content:"|0e|easy-ns-server|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elbacilof.com (threat)"; content:"|09|elbacilof|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exequtor.com (phishing )"; content:"|08|exequtor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f-best-antispy.com (malware)"; content:"|0e|f-best-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scaner-online.org (rogue )"; content:"|12|fast-scaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scaneronline.org (rogue )"; content:"|11|fast-scaneronline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scanerr-online.org (rogue )"; content:"|13|fast-scanerr-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scanerronline.org (rogue )"; content:"|12|fast-scanerronline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscaner-online.org (rogue )"; content:"|11|fastscaner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscaneronline.org (rogue )"; content:"|10|fastscaneronline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscanerr-online.org (rogue )"; content:"|12|fastscanerr-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsecuresranner.org (rogue )"; content:"|11|fastsecuresranner|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbk-lmages.com (malware)"; content:"|0a|fbk-lmages|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feaiwaej.com (fraud)"; content:"|08|feaiwaej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fight-spyware3.com (malware)"; content:"|0e|fight-spyware3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightspyware40.com (malware)"; content:"|0e|fightspyware40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightspyware50.com (malware)"; content:"|0e|fightspyware50|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightspyware60.com (malware)"; content:"|0e|fightspyware60|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightspyware70.com (malware)"; content:"|0e|fightspyware70|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightspyware80.com (malware)"; content:"|0e|fightspyware80|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filesinfoonline.com (malware)"; content:"|0f|filesinfoonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foto-point.net (malware)"; content:"|0a|foto-point|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotobucketl.com (malware)"; content:"|0b|fotobucketl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotosforu.com (malware)"; content:"|09|fotosforu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-checker-spyware.org (malware)"; content:"|14|free-checker-spyware|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshsoftware.com (malware)"; content:"|0d|freshsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frognewmedia.com (malware)"; content:"|0c|frognewmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fsalfibored.com (rogue)"; content:"|0b|fsalfibored|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaddem.org (malware)"; content:"|06|gaddem|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get-money-now.net (malware)"; content:"|0d|get-money-now|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get.msx-3.info (malware)"; content:"|03|get|05|msx-3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigabuger44.com (malware)"; content:"|0b|gigabuger44|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gofucktube.com (malware)"; content:"|0a|gofucktube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogobox.com.tw (malware)"; content:"|07|gogobox|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goliathe999.free.fr (malware)"; content:"|0b|goliathe999|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomedicalonl26.com (fraud)"; content:"|0e|gomedicalonl26|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodsexvid.info (malware)"; content:"|0a|goodsexvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatmediaidea.com (malware)"; content:"|0e|greatmediaidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greattechltd.com (malware)"; content:"|0c|greattechltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedoynur.com (fraud)"; content:"|08|hedoynur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup helsint.ru (malware)"; content:"|07|helsint|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highwaytodl.com (phishing )"; content:"|0b|highwaytodl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hnarmettis.com (malware)"; content:"|0a|hnarmettis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hngqt.cn (malware)"; content:"|05|hngqt|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosteable.com (malware)"; content:"|09|hosteable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting1.nl.santrex.net (phishing )"; content:"|08|hosting1|02|nl|07|santrex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotsexkino.info (malware)"; content:"|0a|hotsexkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotxtube.in (malware)"; content:"|08|hotxtube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotxxxtubevideo.com (malware)"; content:"|0f|hotxxxtubevideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iaeiiroi.com (fraud)"; content:"|08|iaeiiroi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieuugiip.com (fraud)"; content:"|08|ieuugiip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifjsdafibn.fileave.com (malware)"; content:"|0a|ifjsdafibn|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igs-ch.com (malware)"; content:"|06|igs-ch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illuminati666.org (exploitkit )"; content:"|0d|illuminati666|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imyspace-photos.com (malware)"; content:"|0f|imyspace-photos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indianmain.com (threat)"; content:"|0a|indianmain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ingleasing.pl (malware)"; content:"|0a|ingleasing|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innuygeykgtz.com (malware)"; content:"|0c|innuygeykgtz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup installstorm.com (malware)"; content:"|0c|installstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ip.setheo.com (malware)"; content:"|02|ip|06|setheo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipp.co.kr (malware)"; content:"|03|ipp|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k3k2k1.com (malware)"; content:"|06|k3k2k1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup katvixen.com (malware)"; content:"|08|katvixen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kavonsaw.com (fraud)"; content:"|08|kavonsaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keralawebhosting.biz (malware)"; content:"|10|keralawebhosting|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kerrimckeetq.info (malicious)"; content:"|0c|kerrimckeetq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kid.cx (malware)"; content:"|03|kid|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiqebgiq.com (fraud)"; content:"|08|kiqebgiq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kretanlkam.biz (malware)"; content:"|0a|kretanlkam|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kupersextube.com (malware)"; content:"|0c|kupersextube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l2-scanner.com (fastflux_rogue)"; content:"|0a|l2-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l3-scanner.com (fastflux_rogue)"; content:"|0a|l3-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l4-scanner.com (fastflux_rogue)"; content:"|0a|l4-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lab-news.info (malware)"; content:"|08|lab-news|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lab-news.org (malware)"; content:"|08|lab-news|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legallywildbunch.info (malware)"; content:"|10|legallywildbunch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lineq8.100free.com (malware)"; content:"|06|lineq8|07|100free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linksandz.com (exploitkit )"; content:"|09|linksandz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loaddataonline.com (malware)"; content:"|0e|loaddataonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loadsoftsolutions.com (malware)"; content:"|11|loadsoftsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logty.in (malware)"; content:"|05|logty|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loniaduq.com (fraud)"; content:"|08|loniaduq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup losotrana.com (exploit)"; content:"|09|losotrana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovelaser.co.uk (malware)"; content:"|09|lovelaser|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lucas10.hpg.com.br (malware)"; content:"|07|lucas10|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup margaretiamges.com (malware)"; content:"|0e|margaretiamges|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mathematics2u.co.cc (malware)"; content:"|0d|mathematics2u|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediagunsoftware.com (malware)"; content:"|10|mediagunsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz1.com (rogue)"; content:"|0b|megasavezz1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz2.com (rogue)"; content:"|0b|megasavezz2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz3.com (rogue)"; content:"|0b|megasavezz3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz4.com (rogue)"; content:"|0b|megasavezz4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz5.com (rogue)"; content:"|0b|megasavezz5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz6.com (rogue)"; content:"|0b|megasavezz6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz7.com (rogue)"; content:"|0b|megasavezz7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz8.com (rogue)"; content:"|0b|megasavezz8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megasavezz9.com (rogue)"; content:"|0b|megasavezz9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-400.com (malware)"; content:"|0d|microsoft-400|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-updates.co.cc (malware)"; content:"|11|microsoft-updates|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mondinteractive.com (malware)"; content:"|0f|mondinteractive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ms-sitelist.com (malware)"; content:"|0b|ms-sitelist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multimedialabel.com (malware)"; content:"|0f|multimedialabel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-antivirusplus.org (rogue )"; content:"|10|my-antivirusplus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my.icm.dn.ua (malware)"; content:"|02|my|03|icm|02|dn|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantivirus-plus.org (rogue )"; content:"|10|myantivirus-plus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myartsauction.com (malware)"; content:"|0d|myartsauction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myblogweb.freewebhostx.com (malware)"; content:"|09|myblogweb|0c|freewebhostx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mybox.freehosting.com (malware)"; content:"|05|mybox|0b|freehosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myprotectonline.org (rogue )"; content:"|0f|myprotectonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspace-lmg.com (malware)"; content:"|0b|myspace-lmg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywoodarts.com (malware)"; content:"|0a|mywoodarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nanebcuu.com (fraud)"; content:"|08|nanebcuu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newlisbon.cn (malware)"; content:"|09|newlisbon|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns00ns11.com (malware)"; content:"|08|ns00ns11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p11.hostingprod.com (malware)"; content:"|03|p11|0b|hostingprod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup p2pcontrol.com (malware)"; content:"|0a|p2pcontrol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pc-optimizer.com (malware)"; content:"|0c|pc-optimizer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phatobuckats.com (malware)"; content:"|0c|phatobuckats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup potectmesage.com (rogue)"; content:"|0c|potectmesage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pretection-page.com (rogue)"; content:"|0f|pretection-page|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protected.authorized-payments.com (rogue)"; content:"|09|protected|13|authorized-payments|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-mesage.com (rogue)"; content:"|11|protection-mesage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protection-messag.com (rogue)"; content:"|11|protection-messag|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxghq.in (malware)"; content:"|05|pxghq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r2d2porn.com (malware)"; content:"|08|r2d2porn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radarixo.com (neosploit)"; content:"|08|radarixo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radiopoptrelew.com.ar (malware)"; content:"|0e|radiopoptrelew|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup readyhelper.com (malware)"; content:"|0b|readyhelper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rodfirst.com (malware)"; content:"|08|rodfirst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rowfirst.com (malware)"; content:"|08|rowfirst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruexp1.ru (malware)"; content:"|06|ruexp1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruspornokino.info (malware)"; content:"|0c|ruspornokino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s281.net (malware)"; content:"|04|s281|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saratogaestate.com (malware)"; content:"|0e|saratogaestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saraxxxsite.com (malware)"; content:"|0b|saraxxxsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sc-counter.com (malware)"; content:"|0a|sc-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdfp.sggw.pl (malware)"; content:"|04|sdfp|04|sggw|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-gala.com (malware)"; content:"|0b|search-gala|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchleaup.org (malware)"; content:"|0b|searchleaup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure.greywall.net (rogue)"; content:"|06|secure|08|greywall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitymental.com (malware)"; content:"|0e|securitymental|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitysafetyasia.info (neosplit)"; content:"|12|securitysafetyasia|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup server2.ss2.name (malware)"; content:"|07|server2|03|ss2|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sfah3sz.com (malware)"; content:"|07|sfah3sz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shockstreams.com (phishing )"; content:"|0c|shockstreams|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showersystemreviews.com (malware)"; content:"|13|showersystemreviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simplemediaonline.com (malware)"; content:"|11|simplemediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slzzcom.com (malware)"; content:"|07|slzzcom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socialistiscandicci.it (malware)"; content:"|13|socialistiscandicci|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwaredload.com (malware)"; content:"|0d|softwaredload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sortingphotos.com (malware)"; content:"|0d|sortingphotos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space4lmages.net (malware)"; content:"|0c|space4lmages|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stars-vs-stars.com (trojan)"; content:"|0e|stars-vs-stars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sugarqane.com (malware)"; content:"|09|sugarqane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supportdialog.net (rogue)"; content:"|0d|supportdialog|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-mesage.com (rogue)"; content:"|0a|sys-mesage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-protect-online.org (rogue )"; content:"|12|sys-protect-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syssmessage.com (rogue)"; content:"|0b|syssmessage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysstem-mesage.com (rogue)"; content:"|0e|sysstem-mesage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systwm.org (malware)"; content:"|06|systwm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testsystem-3.com (malware)"; content:"|0c|testsystem-3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treplikon.com (malicious)"; content:"|09|treplikon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup velokot.org (malware)"; content:"|07|velokot|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup version-upgrade.com (malware)"; content:"|0f|version-upgrade|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipphotosonline.net (malware)"; content:"|0f|vipphotosonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vladlen.real-host.ru (malware)"; content:"|07|vladlen|09|real-host|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vost.cz (threat)"; content:"|04|vost|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w3a-defence.com (fastflux_rogue)"; content:"|0b|w3a-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w4a-defence.com (fastflux_rogue)"; content:"|0b|w4a-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w5a-defence.com (fastflux_rogue)"; content:"|0b|w5a-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w6a-defence.com (fastflux_rogue)"; content:"|0b|w6a-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup w7a-defence.com (fastflux_rogue)"; content:"|0b|w7a-defence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wc-search.com (malware)"; content:"|09|wc-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpromasters.info (malware)"; content:"|0d|webpromasters|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websstatus.com (malware)"; content:"|0a|websstatus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotect2.com (fastflux_rogue)"; content:"|0f|windowsprotect2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotect3.com (fastflux_rogue)"; content:"|0f|windowsprotect3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotect4.com (fastflux_rogue)"; content:"|0f|windowsprotect4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotect5.com (fastflux_rogue)"; content:"|0f|windowsprotect5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowsprotect6.com (fastflux_rogue)"; content:"|0f|windowsprotect6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotect3.com (fastflux_rogue)"; content:"|0b|winprotect3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotect5.com (fastflux_rogue)"; content:"|0b|winprotect5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotect7.com (fastflux_rogue)"; content:"|0b|winprotect7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotect8.com (fastflux_rogue)"; content:"|0b|winprotect8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winprotect9.com (fastflux_rogue)"; content:"|0b|winprotect9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldwesttrans.com (malware)"; content:"|0e|worldwesttrans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worldwide4.co.uk (malware)"; content:"|0a|worldwide4|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdfotos.hpg.com.br (malware)"; content:"|07|xdfotos|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmovies2you.com (malware)"; content:"|0b|xmovies2you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yargostinica.ru (malware)"; content:"|0c|yargostinica|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ylber.freehosting.com (malware)"; content:"|05|ylber|0b|freehosting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0web-antispyware.com (koobface)"; content:"|10|0web-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 123m.info (malware)"; content:"|04|123m|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 12netantispy.com (koobface)"; content:"|0c|12netantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 13netantispy.com (koobface)"; content:"|0c|13netantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 14netantispy.com (koobface)"; content:"|0c|14netantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 16netantispy.com (koobface)"; content:"|0c|16netantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1anetantispy.com (koobface)"; content:"|0c|1anetantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1bnetantispy.com (koobface)"; content:"|0c|1bnetantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1gb-scanner.com (koobface)"; content:"|0b|1gb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1gig-antivirus.com (koobface)"; content:"|0e|1gig-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1webantivirus.com (koobface)"; content:"|0d|1webantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1zabslwvn538n4i5tcjl.com (koobface)"; content:"|14|1zabslwvn538n4i5tcjl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 20gb-antivirus.com (koobface)"; content:"|0e|20gb-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2gb-scanner.com (koobface)"; content:"|0b|2gb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2gig-antivirus.com (koobface)"; content:"|0e|2gig-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2mb-scanner.com (koobface)"; content:"|0b|2mb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2web-antispy.com (koobface)"; content:"|0c|2web-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2webantivirus.com (koobface)"; content:"|0d|2webantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30gb-antivirus.com (koobface)"; content:"|0e|30gb-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3gb-scanner.com (koobface)"; content:"|0b|3gb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3gig-antivirus.com (koobface)"; content:"|0e|3gig-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3mb-scanner.com (koobface)"; content:"|0b|3mb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3web-antispy.com (koobface)"; content:"|0c|3web-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3web-antispyware.com (koobface)"; content:"|10|3web-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3webantivirus.com (koobface)"; content:"|0d|3webantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 40gb-antivirus.com (koobface)"; content:"|0e|40gb-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4gb-scanner.com (koobface)"; content:"|0b|4gb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4gig-antivirus.com (koobface)"; content:"|0e|4gig-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4mb-scanner.com (koobface)"; content:"|0b|4mb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4web-antispy.com (koobface)"; content:"|0c|4web-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4webantivirus.com (koobface)"; content:"|0d|4webantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 50gb-antivirus.com (koobface)"; content:"|0e|50gb-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5gb-scanner.com (koobface)"; content:"|0b|5gb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5gig-antivirus.com (koobface)"; content:"|0e|5gig-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5mb-scanner.com (koobface)"; content:"|0b|5mb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5web-antispy.com (koobface)"; content:"|0c|5web-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5webantivirus.com (koobface)"; content:"|0d|5webantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 60gb-antivirus.com (koobface)"; content:"|0e|60gb-antivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6mb-scanner.com (koobface)"; content:"|0b|6mb-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6web-antispy.com (koobface)"; content:"|0c|6web-antispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7web-antispyware.com (koobface)"; content:"|10|7web-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8my-antispyware.com (risk)"; content:"|0f|8my-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-special.net (rogue)"; content:"|0a|av-special|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aweb-antispyware.com (koobface)"; content:"|10|aweb-antispyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awebantivirus.com (koobface)"; content:"|0d|awebantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awindows-scan.com (rogue)"; content:"|0d|awindows-scan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b1xs.com (zbot)"; content:"|04|b1xs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestmortgagefind.cn (malware)"; content:"|10|bestmortgagefind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestnameshop.cn (malware)"; content:"|0c|bestnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigbestfind.cn (malware)"; content:"|0b|bigbestfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopmanagement.cn (malware)"; content:"|10|bigtopmanagement|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bprotectsystem.com (rogue)"; content:"|0e|bprotectsystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chakra.master-networking.net (zeus)"; content:"|06|chakra|11|master-networking|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comandav.com (malware)"; content:"|08|comandav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cribrejist.kz (zeus)"; content:"|0a|cribrejist|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cwebantivirus.com (koobface)"; content:"|0d|cwebantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dating-spot.ru (fastflux)"; content:"|0b|dating-spot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deewaek4heeh.kz (zeus)"; content:"|0c|deewaek4heeh|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dieta-24.ru (fastflux)"; content:"|08|dieta-24|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugs-prostore.com (fastflux)"; content:"|0e|drugs-prostore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwebantivirus.com (koobface)"; content:"|0d|dwebantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup englishbusinessok.info (neosploit)"; content:"|11|englishbusinessok|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evilpal.ru (fastflux)"; content:"|07|evilpal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewebantivirus.com (koobface)"; content:"|0d|ewebantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsearch.cz.cc (koobface)"; content:"|0a|fastsearch|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fialfyjfvif.com (torping)"; content:"|0b|fialfyjfvif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fivefingers31.org (zbot)"; content:"|0d|fivefingers31|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeipg.ru (exploit)"; content:"|07|freeipg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaihooxaefap.com (zeus)"; content:"|0c|gaihooxaefap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gestionmunicipal.org.py (malware)"; content:"|10|gestionmunicipal|03|org|02|py"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getdrugs-store.com (fastflux)"; content:"|0e|getdrugs-store|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapayfosus.com (zbot)"; content:"|0c|gigapayfosus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habibaksa.net (zbot)"; content:"|09|habibaksa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haijeihefoobeekahkohweto.com (fastflux)"; content:"|18|haijeihefoobeekahkohweto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haveitornot.ru (exploit)"; content:"|0b|haveitornot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hesneclimi.ru (zeus)"; content:"|0a|hesneclimi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holasionweb.com (attack)"; content:"|0b|holasionweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulejsoops.ru (malware)"; content:"|0a|hulejsoops|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hypoload.in (malware)"; content:"|08|hypoload|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ielaithereej.com (zeus)"; content:"|0c|ielaithereej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijll.ru (malware)"; content:"|04|ijll|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illmap.ru (fastflux)"; content:"|06|illmap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img410.imageshacks.in (malware)"; content:"|06|img410|0b|imageshacks|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img4453945.com (zeus)"; content:"|0a|img4453945|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indypages.ru (malware)"; content:"|09|indypages|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup innerduck.ru (malware)"; content:"|09|innerduck|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iomegaone.com (fastflux)"; content:"|09|iomegaone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irnis.net (malware)"; content:"|05|irnis|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjll.ru (malware)"; content:"|04|jjll|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicyfile.ru (malware)"; content:"|09|juicyfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k2onlinesatis.com (malware)"; content:"|0d|k2onlinesatis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kakleglo2335.com (malware)"; content:"|0c|kakleglo2335|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kettych.com (trojan)"; content:"|07|kettych|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kghxpwukvif.com (torping)"; content:"|0b|kghxpwukvif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kh76t.3322.org (malware)"; content:"|05|kh76t|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup labelstare.ru (malware)"; content:"|0a|labelstare|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latevenom.ru (malware)"; content:"|09|latevenom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lazyloss.ru (malware)"; content:"|08|lazyloss|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leakymaid.ru (malware)"; content:"|09|leakymaid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ledorga.fr (phishing)"; content:"|07|ledorga|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessjazz.ru (malware)"; content:"|08|lessjazz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightword.ru (malware)"; content:"|09|lightword|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup like-me-web.com (malware)"; content:"|0b|like-me-web|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lostdeed.ru (malware)"; content:"|08|lostdeed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovemine.ru (malware)"; content:"|08|lovemine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lunchscone.ru (malware)"; content:"|0a|lunchscone|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabhkkemvif.com (torping)"; content:"|0b|mabhkkemvif|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macroarea.ru (malware)"; content:"|09|macroarea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magic-dieta.ru (fastflux)"; content:"|0b|magic-dieta|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamapapalol.com (malware)"; content:"|0b|mamapapalol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicinada.com (malware)"; content:"|0a|medicinada|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micmarket.ru (malware)"; content:"|09|micmarket|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microdoor.ru (malware)"; content:"|09|microdoor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mildroom.ru (malware)"; content:"|08|mildroom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miniarms.ru (malware)"; content:"|08|miniarms|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ministate.ru (malware)"; content:"|09|ministate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missgin.ru (malware)"; content:"|07|missgin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modelprod.ru (malware)"; content:"|09|modelprod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mondaybubble.ru (malware)"; content:"|0c|mondaybubble|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mondayring.ru (malware)"; content:"|0a|mondayring|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mushylion.ru (malware)"; content:"|09|mushylion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypc-services10.com (zbot)"; content:"|0f|mypc-services10|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n9uo.com (malware)"; content:"|04|n9uo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup navigationquebec.com (malware)"; content:"|10|navigationquebec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nearzit.ru (malware)"; content:"|07|nearzit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup needtempt.ru (malware)"; content:"|09|needtempt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netgomarket.com (malware)"; content:"|0b|netgomarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nethabercilik.com (malicious)"; content:"|0d|nethabercilik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettps.net (fastflux)"; content:"|06|nettps|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noislant.com (malware)"; content:"|08|noislant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noknack.ru (malware)"; content:"|07|noknack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nonstopsen.com (malware)"; content:"|0a|nonstopsen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nosypipe.ru (malware)"; content:"|08|nosypipe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nothill.ru (malware)"; content:"|07|nothill|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notkey.ru (malware)"; content:"|06|notkey|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novascanner4.com (koobface)"; content:"|0c|novascanner4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyfrizymiq.net (zeus)"; content:"|0a|nyfrizymiq|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obele-chuka.com (malware)"; content:"|0b|obele-chuka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oddbabe.ru (malware)"; content:"|07|oddbabe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ohjeugbomlc.com (neosploit)"; content:"|0b|ohjeugbomlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldcarsforrent.com (zeus)"; content:"|0e|oldcarsforrent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oldpresident.ru (malware)"; content:"|0c|oldpresident|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onebeard.ru (malware)"; content:"|08|onebeard|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onewinter.ru (malware)"; content:"|09|onewinter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ourriver.ru (malware)"; content:"|08|ourriver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ownload-hosting-free.biz (malware)"; content:"|14|ownload-hosting-free|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pangreed.ru (malware)"; content:"|08|pangreed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pearlpole.ru (malware)"; content:"|09|pearlpole|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petlips.ru (malware)"; content:"|07|petlips|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petquestion.ru (malware)"; content:"|0b|petquestion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petsample.ru (malware)"; content:"|09|petsample|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup petwife.ru (malware)"; content:"|07|petwife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phpgrinchalina5.com (exploit)"; content:"|0f|phpgrinchalina5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pinkhack.ru (malware)"; content:"|08|pinkhack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup politicalpoets.ru (malware)"; content:"|0e|politicalpoets|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powerbarrel.ru (malware)"; content:"|0b|powerbarrel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prickheal.ru (malware)"; content:"|09|prickheal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priorface.ru (malware)"; content:"|09|priorface|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup priorsmell.ru (malware)"; content:"|0a|priorsmell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radicalgirl.ru (malware)"; content:"|0b|radicalgirl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radjoker.ru (malware)"; content:"|08|radjoker|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radtune.ru (malware)"; content:"|07|radtune|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rareelf.ru (malware)"; content:"|07|rareelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rarephone.ru (malware)"; content:"|09|rarephone|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rattyduck.ru (malware)"; content:"|09|rattyduck|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rawshower.ru (malware)"; content:"|09|rawshower|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red-xxx-tube.net (malware)"; content:"|0c|red-xxx-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redspinster.ru (malware)"; content:"|0b|redspinster|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redwriter.ru (malware)"; content:"|09|redwriter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relaxedgrape.ru (malware)"; content:"|0c|relaxedgrape|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richsign.ru (malware)"; content:"|08|richsign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rmtiw324.ru (malware)"; content:"|08|rmtiw324|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robot114.com (malware)"; content:"|08|robot114|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romantube.ru (malware)"; content:"|09|romantube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundgain.ru (malware)"; content:"|09|roundgain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundhour.ru (malware)"; content:"|09|roundhour|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundmaker.ru (malware)"; content:"|0a|roundmaker|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundpad.ru (malware)"; content:"|08|roundpad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roundroad.ru (malware)"; content:"|09|roundroad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs358l32.rapidshare.com (malware)"; content:"|08|rs358l32|0a|rapidshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s1system.com (koobface)"; content:"|08|s1system|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saltyriver.ru (malware)"; content:"|0a|saltyriver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saltysky.ru (malware)"; content:"|08|saltysky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scaryloss.ru (malware)"; content:"|09|scaryloss|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secretaxe.ru (malware)"; content:"|09|secretaxe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securityinternacces.com (malware)"; content:"|13|securityinternacces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shiftsoftware.info (malware)"; content:"|0d|shiftsoftware|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shiftupdate.info (trojan )"; content:"|0b|shiftupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shinyrock.ru (malware)"; content:"|09|shinyrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortfeet.ru (malware)"; content:"|09|shortfeet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siliconemist.ru (malware)"; content:"|0c|siliconemist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skepticalpub.ru (malware)"; content:"|0c|skepticalpub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sleepydream.ru (malware)"; content:"|0b|sleepydream|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slickfilm.ru (malware)"; content:"|09|slickfilm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallbars.ru (malware)"; content:"|09|smallbars|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartsupersecurity.com (malware)"; content:"|12|smartsupersecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softstage.ru (malware)"; content:"|09|softstage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soggyzero.ru (malware)"; content:"|09|soggyzero|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soreentry.ru (malware)"; content:"|09|soreentry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soundrisk.ru (malware)"; content:"|09|soundrisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup southernpeg.ru (malware)"; content:"|0b|southernpeg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparechief.ru (malware)"; content:"|0a|sparechief|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparemat.ru (malware)"; content:"|08|sparemat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spellload.ru (malware)"; content:"|09|spellload|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spicyledge.ru (malware)"; content:"|0a|spicyledge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spicyyear.ru (malware)"; content:"|09|spicyyear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spotsnow.ru (malware)"; content:"|08|spotsnow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup springarctic.ru (malware)"; content:"|0c|springarctic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallshare.ru (malware)"; content:"|0a|stallshare|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stellarshower.ru (malware)"; content:"|0d|stellarshower|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuckdate.ru (malware)"; content:"|09|stuckdate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffstep.ru (malware)"; content:"|09|stuffstep|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suavepad.ru (malware)"; content:"|08|suavepad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subroyalty.ru (malware)"; content:"|0a|subroyalty|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup surechip.ru (malware)"; content:"|08|surechip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tallpen.ru (malware)"; content:"|07|tallpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tameconcert.ru (malware)"; content:"|0b|tameconcert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tangystar.ru (malware)"; content:"|09|tangystar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tapclip.ru (malware)"; content:"|07|tapclip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tartshow.ru (malware)"; content:"|08|tartshow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tastysea.ru (malware)"; content:"|08|tastysea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telechart.ru (malware)"; content:"|09|telechart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tenderavatar.ru (malware)"; content:"|0c|tenderavatar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tenthprofit.ru (malware)"; content:"|0b|tenthprofit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terminalpoem.ru (malware)"; content:"|0c|terminalpoem|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tightspace.ru (malware)"; content:"|0a|tightspace|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torncurrent.ru (malware)"; content:"|0b|torncurrent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tornmum.ru (malware)"; content:"|07|tornmum|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u678.info (malware)"; content:"|04|u678|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimatecomfort.ru (malware)"; content:"|0f|ultimatecomfort|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updt334221.com (virus)"; content:"|0a|updt334221|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urbandream.ru (malware)"; content:"|0a|urbandream|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usetune.ru (malware)"; content:"|07|usetune|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v3p2.com (malware)"; content:"|04|v3p2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup validbanner.ru (malware)"; content:"|0b|validbanner|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup validfolk.ru (malware)"; content:"|09|validfolk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valuablemind.ru (malware)"; content:"|0c|valuablemind|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vastdiary.ru (malware)"; content:"|09|vastdiary|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vastinsect.ru (malware)"; content:"|0a|vastinsect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vastobject.ru (malware)"; content:"|0a|vastobject|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vasttune.ru (malware)"; content:"|08|vasttune|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videohubb.in (malware)"; content:"|09|videohubb|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup void99.com (zeus)"; content:"|06|void99|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wantdive.ru (malware)"; content:"|08|wantdive|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weakimage.ru (malware)"; content:"|09|weakimage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wearyyear.ru (malware)"; content:"|09|wearyyear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webguardyourpc-33p.net (hack)"; content:"|12|webguardyourpc-33p|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webpregnantget.com (malware)"; content:"|0e|webpregnantget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westlips.ru (malware)"; content:"|08|westlips|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup worstfuel.ru (malware)"; content:"|09|worstfuel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wovenshelf.ru (malware)"; content:"|0a|wovenshelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtopcompany.biz (malware)"; content:"|0b|wtopcompany|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wutrinfe.com (exploit)"; content:"|08|wutrinfe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xee1aeph2aay.kz (zeus)"; content:"|0c|xee1aeph2aay|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmoose.ru (malware)"; content:"|09|yourmoose|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yoursoap.ru (malware)"; content:"|08|yoursoap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zerovir.com (malware)"; content:"|07|zerovir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziniomags.com.cn (zbot)"; content:"|09|ziniomags|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zipbin.ru (malware)"; content:"|06|zipbin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfinderr.cn (malware)"; content:"|0b|bestfinderr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediahousenamemartmovie.cn (injection)"; content:"|17|mediahousenamemartmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2iii.org (malware)"; content:"|04|2iii|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 40quizu.org (malware)"; content:"|07|40quizu|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adult-videohunt.co.cc (malware)"; content:"|0f|adult-videohunt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allovahc.com (malware)"; content:"|08|allovahc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allstockdata.com (malware)"; content:"|0c|allstockdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aramitri.com (malware)"; content:"|08|aramitri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arieljohn316.com (malware)"; content:"|0c|arieljohn316|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asbridgesburn.biz (malware)"; content:"|0d|asbridgesburn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asf356ydc.com (malware)"; content:"|09|asf356ydc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashdog.ru (malware)"; content:"|06|ashdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atlascounter.com (malware)"; content:"|0c|atlascounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baronessan.se (malware)"; content:"|0a|baronessan|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beelinfire.com (malware)"; content:"|0a|beelinfire|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestokuma.info (malware)"; content:"|09|bestokuma|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bests-tracks.com (malware)"; content:"|0c|bests-tracks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betterpoint.net (malware)"; content:"|0b|betterpoint|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bierapot.info (malware)"; content:"|08|bierapot|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blasphemy774.info (malware)"; content:"|0c|blasphemy774|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmthungary.hu (malware)"; content:"|0a|bmthungary|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bonutilites.com (malware)"; content:"|0b|bonutilites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bp.ranahdamai.org (malware)"; content:"|02|bp|0a|ranahdamai|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broad9.com (malware)"; content:"|06|broad9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bubendockader.com (malware)"; content:"|0d|bubendockader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup businessokworld.info (malware)"; content:"|0f|businessokworld|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carouselfineart.com (malware)"; content:"|0f|carouselfineart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combicorm.com (malware)"; content:"|09|combicorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cria-worgsxx2.serveirc.com (malware)"; content:"|0d|cria-worgsxx2|08|serveirc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctrlsecurityproducts.info (malware)"; content:"|14|ctrlsecurityproducts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-fox.com (malware)"; content:"|09|cyber-fox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czickenpower.com (malware)"; content:"|0c|czickenpower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup d0ma1ns.info (malware)"; content:"|07|d0ma1ns|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailynovelty.com (malware)"; content:"|0c|dailynovelty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddleb.com (malware)"; content:"|05|ddleb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dersausko.ru (malware)"; content:"|09|dersausko|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup develo89.ru (malware)"; content:"|08|develo89|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdmovielabel.com (malware)"; content:"|0d|dvdmovielabel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edu.jccm.es (malware)"; content:"|03|edu|04|jccm|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekmotorfactors.co.uk (malware)"; content:"|0e|ekmotorfactors|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ekospor.com (malware)"; content:"|07|ekospor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epolikto.com (malware)"; content:"|08|epolikto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ertopolk.ru (malware)"; content:"|08|ertopolk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezmediasoftware.com (malware)"; content:"|0f|ezmediasoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup face-profiles.com (malware)"; content:"|0d|face-profiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup face-profiles.net (malware)"; content:"|0d|face-profiles|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebook.spaceb-blogs.com (malware)"; content:"|08|facebook|0c|spaceb-blogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup facebooksave.space-blogs.net (malware)"; content:"|0c|facebooksave|0b|space-blogs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farsearch.tw (malware)"; content:"|09|farsearch|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fbhole.com (scam)"; content:"|06|fbhole|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file.ygfamily.com (malware)"; content:"|04|file|08|ygfamily|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findergif.org (malware)"; content:"|09|findergif|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flickergoogle.kilu.de (malware)"; content:"|0d|flickergoogle|04|kilu|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fracebook-img.com (malware)"; content:"|0d|fracebook-img|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gangmywife.net (malware)"; content:"|0a|gangmywife|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geleiance.com (malware)"; content:"|09|geleiance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalmediazone.com (malware)"; content:"|0f|globalmediazone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glunis.googlegroups.com (malware)"; content:"|06|glunis|0c|googlegroups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatwebmultimedia.com (malware)"; content:"|12|greatwebmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hambd.com (malware)"; content:"|05|hambd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hhioj.net (malware)"; content:"|05|hhioj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homeideass.com (malware)"; content:"|0a|homeideass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup honeysp.in (malware)"; content:"|07|honeysp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostingpanelavg.com (malware)"; content:"|0f|hostingpanelavg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hulinadobaranublja.com (malware)"; content:"|12|hulinadobaranublja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idefavcimlc.com (malware)"; content:"|0b|idefavcimlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ili-lala-ili.com (malware)"; content:"|0c|ili-lala-ili|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iloadmedia.com (malware)"; content:"|0a|iloadmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imunno.biz (malware)"; content:"|06|imunno|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info-fblogs.com (malware)"; content:"|0b|info-fblogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infos-fblog.com (malware)"; content:"|0b|infos-fblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup karissmikksa.com (malware)"; content:"|0c|karissmikksa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ku1.installstorm.com (malware)"; content:"|03|ku1|0c|installstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup l1sex.com (malware)"; content:"|05|l1sex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakobhoons.com (malware)"; content:"|0a|lakobhoons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lindsaydavis.com (malware)"; content:"|0c|lindsaydavis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkda.info (malware)"; content:"|04|lkda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lmagesfacebook.com (malware)"; content:"|0e|lmagesfacebook|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup logodataonline.com (malware)"; content:"|0e|logodataonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovexxxs.googlegroups.com (malware)"; content:"|08|lovexxxs|0c|googlegroups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maccrack.ru (malware)"; content:"|08|maccrack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediacreatedirect.com (malware)"; content:"|11|mediacreatedirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medialessonsworld.com (malware)"; content:"|11|medialessonsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaonlinecode.com (malware)"; content:"|0f|mediaonlinecode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microantivirus1g.com (malware)"; content:"|10|microantivirus1g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moremediaonline.com (malware)"; content:"|0f|moremediaonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviestandartonline.com (malware)"; content:"|13|moviestandartonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musemegadata.com (malware)"; content:"|0c|musemegadata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutlulugunsirri.net (malware)"; content:"|0f|mutlulugunsirri|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myhotporn.in (malware)"; content:"|09|myhotporn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myldxs.com (malware)"; content:"|06|myldxs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkgreengo.com (malware)"; content:"|0e|networkgreengo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noafirst.com (malware)"; content:"|08|noafirst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinesoftware.us (malware)"; content:"|0e|onlinesoftware|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patricknetgo.com (malware)"; content:"|0c|patricknetgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photo-fbspace.com (malware)"; content:"|0d|photo-fbspace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photos1.co.cc (malware)"; content:"|07|photos1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phpdatatools.com (malware)"; content:"|0c|phpdatatools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornsextube.in (malware)"; content:"|0b|pornsextube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxnow.in (malware)"; content:"|05|pxnow|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup revenders.pl (malware)"; content:"|09|revenders|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruxyjatech.com (malware)"; content:"|0a|ruxyjatech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sarumstud.com (malware)"; content:"|09|sarumstud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup save.spaces-blogs.com (malware)"; content:"|04|save|0c|spaces-blogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchadvertsol.net (malware)"; content:"|0f|searchadvertsol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seemorevideo.com (malware)"; content:"|0c|seemorevideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selcukduracik.com (malware)"; content:"|0d|selcukduracik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seppx.in (malware)"; content:"|05|seppx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servetheprofit.servehttp.com (malware)"; content:"|0e|servetheprofit|09|servehttp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serviceexe.com (malware)"; content:"|0a|serviceexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setyupdate.com (malware)"; content:"|0a|setyupdate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup site.deborahgautney.com (malware)"; content:"|04|site|0e|deborahgautney|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spaces-blogs.com (malware)"; content:"|0c|spaces-blogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stop140spyware.com (malware)"; content:"|0e|stop140spyware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stopfeiksite.com (malware)"; content:"|0c|stopfeiksite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfreetools.com (malware)"; content:"|0e|superfreetools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tellusforalife.us (malware)"; content:"|0e|tellusforalife|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thedigitalinfo.com (malware)"; content:"|0e|thedigitalinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themediagadget.com (malware)"; content:"|0e|themediagadget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topcarmitsubishi.com.br (malware)"; content:"|10|topcarmitsubishi|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tracker.bizrgm.com (malware)"; content:"|07|tracker|06|bizrgm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trainfucked.com (malware)"; content:"|0b|trainfucked|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turismorapido.com.br (malware)"; content:"|0d|turismorapido|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultimatemediaplanet.com (malware)"; content:"|13|ultimatemediaplanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umpresenteperfeito.com.br (malware)"; content:"|12|umpresenteperfeito|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatemicd.in (malware)"; content:"|0a|updatemicd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usaqvod.com (malware)"; content:"|07|usaqvod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voaxutiy.com.tw (malware)"; content:"|08|voaxutiy|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webaliveget.com (malware)"; content:"|0b|webaliveget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgettraffic.com (malware)"; content:"|0d|webgettraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wemhkr3t4z.com (malware)"; content:"|0a|wemhkr3t4z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wmbarnaul.info (malware)"; content:"|09|wmbarnaul|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wwww.86wen.com (malware)"; content:"|04|wwww|05|86wen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfreeporntube.in (malware)"; content:"|0d|xfreeporntube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xiao0.ui18.xicp.cn (malware)"; content:"|05|xiao0|04|ui18|04|xicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxpornhub.in (malware)"; content:"|0a|xxxpornhub|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourfilesnow.com (malware)"; content:"|0c|yourfilesnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourkep.com (malware)"; content:"|07|yourkep|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourmediacode.com (malware)"; content:"|0d|yourmediacode|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoonu29.org (malware)"; content:"|07|zoonu29|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 000007.ru (harmful)"; content:"|06|000007|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 00g00.ru (malicious)"; content:"|05|00g00|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 15netantispy.com (rogue)"; content:"|0c|15netantispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 375316d67.7threat-scanner.com (rogue)"; content:"|09|375316d67|0f|7threat-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aejoq.info (neosploit)"; content:"|05|aejoq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alananlaw.com (trojan)"; content:"|09|alananlaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allforil1i.com (malicious)"; content:"|0a|allforil1i|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allforyouplus.net (malicious)"; content:"|0d|allforyouplus|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alltubeforfree.com (malicious)"; content:"|0e|alltubeforfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allxtubevids.net (malicious)"; content:"|0c|allxtubevids|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-tool.net (rogue)"; content:"|0c|antispy-tool|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup axtil.info (neosploit)"; content:"|05|axtil|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baseofmp3.com (harmful)"; content:"|09|baseofmp3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basurm.com (zeus)"; content:"|06|basurm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbnhs.com (exploit)"; content:"|05|bbnhs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beeape.com (malicious)"; content:"|06|beeape|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beralz.info (neosploit)"; content:"|06|beralz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsnews.info (neosploit)"; content:"|09|bestsnews|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bibigom.info (neosploit)"; content:"|07|bibigom|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigimi.net (harmful)"; content:"|06|bigimi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigwebs.info (neosploit)"; content:"|07|bigwebs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billingonline.net (malicious)"; content:"|0d|billingonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billsolutions.net (malicious)"; content:"|0d|billsolutions|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bindstat.cn (c&c)"; content:"|08|bindstat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bombastats.com (malicious)"; content:"|0a|bombastats|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boonex.com (crimepack)"; content:"|06|boonex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bopsi.info (neosploit)"; content:"|05|bopsi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bron.in (malicious)"; content:"|04|bron|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bwebantivirus.com (rogue)"; content:"|0d|bwebantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bygagaze.info (neosploit)"; content:"|08|bygagaze|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camalgori4free.com (harmful)"; content:"|0e|camalgori4free|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup camoler.info (neosploit)"; content:"|07|camoler|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccsline.net (crimepack)"; content:"|07|ccsline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdajuf.info (neosploit)"; content:"|06|cdajuf|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cern-a.com (malicious)"; content:"|06|cern-a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolhils.info (neosploit)"; content:"|08|coolhils|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolparts31.tw (zeus)"; content:"|0b|coolparts31|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolsnews.info (neosploit)"; content:"|09|coolsnews|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cornerrat.ru (c&c)"; content:"|09|cornerrat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cvyogo.info (neosploit)"; content:"|06|cvyogo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dacenete.com (harmful)"; content:"|08|dacenete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup damop.info (neosploit)"; content:"|05|damop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datingtipstricks.info (spyeye)"; content:"|10|datingtipstricks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddkom.biz (zeus)"; content:"|05|ddkom|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demoxxx.info (neosploit)"; content:"|07|demoxxx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup depoys.info (neosploit)"; content:"|06|depoys|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dersis.info (neosploit)"; content:"|06|dersis|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhomuku.info (neosploit)"; content:"|07|dhomuku|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djmx.info (neosploit)"; content:"|04|djmx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup draxesaz.net (exploit)"; content:"|08|draxesaz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dulk.in (malicious)"; content:"|04|dulk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dwygywa.info (neosploit)"; content:"|07|dwygywa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easypayments-online.com (malicious)"; content:"|13|easypayments-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup espacio.dialogomercosur.org (rogue)"; content:"|07|espacio|0f|dialogomercosur|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup excel-biz.net (zeus)"; content:"|09|excel-biz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastglobosearch.com (malicious)"; content:"|0f|fastglobosearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastsecurebilling.com (malicious)"; content:"|11|fastsecurebilling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fewrocker.ru (c&c)"; content:"|09|fewrocker|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firsttunesclub.in (malicious)"; content:"|0e|firsttunesclub|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floralartperu.com (trojan)"; content:"|0d|floralartperu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fobosa.info (neosploit)"; content:"|06|fobosa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foresaleonline.ru (malware)"; content:"|0e|foresaleonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fqojuta.info (neosploit)"; content:"|07|fqojuta|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-web-scaners.biz (rogue)"; content:"|10|free-web-scaners|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-web-scaners.com (rogue)"; content:"|10|free-web-scaners|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-web-scaners.net (rogue)"; content:"|10|free-web-scaners|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-webscaners.net (rogue)"; content:"|0f|free-webscaners|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freepornxmovies.com (trojan)"; content:"|0f|freepornxmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freetube06.com (malicious)"; content:"|0a|freetube06|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeviewgogo.com (malicious)"; content:"|0c|freeviewgogo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnybook.info (neosploit)"; content:"|09|funnybook|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxytumy.info (neosploit)"; content:"|07|fxytumy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geceg.info (neosploit)"; content:"|05|geceg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gefwa.info (neosploit)"; content:"|05|gefwa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfajob.info (neosploit)"; content:"|06|gfajob|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gibrosa.info (neosploit)"; content:"|07|gibrosa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigafleet.ru (c&c)"; content:"|09|gigafleet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigalife.info (harmful)"; content:"|08|gigalife|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gikyliel.info (neosploit)"; content:"|08|gikyliel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glipston.info (exploit)"; content:"|08|glipston|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globaljoke.ru (c&c)"; content:"|0a|globaljoke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glossipfd.com (harmful)"; content:"|09|glossipfd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup godversion20.net (zeus)"; content:"|0c|godversion20|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmsc.info (harmful)"; content:"|07|goldmsc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goorewa.info (neosploit)"; content:"|07|goorewa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goorewb.info (neosploit)"; content:"|07|goorewb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goorewc.info (neosploit)"; content:"|07|goorewc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goorpa.info (neosploit)"; content:"|06|goorpa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goorpg.info (neosploit)"; content:"|06|goorpg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gork.in (malicious)"; content:"|04|gork|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatfile.ru (c&c)"; content:"|09|greatfile|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gripioro.info (neosploit)"; content:"|08|gripioro|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gulk.in (malicious)"; content:"|04|gulk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guop.info (neosploit)"; content:"|04|guop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gwyvisun.info (neosploit)"; content:"|08|gwyvisun|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gxutywau.info (neosploit)"; content:"|08|gxutywau|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gylop.info (neosploit)"; content:"|05|gylop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habibaska.net (zeus)"; content:"|09|habibaska|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup halims.info (neosploit)"; content:"|06|halims|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hnoee.info (neosploit)"; content:"|05|hnoee|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holaj.info (neosploit)"; content:"|05|holaj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotfilesfordownload.com (malicious)"; content:"|13|hotfilesfordownload|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyperantivir2.com (rogue)"; content:"|0d|hyperantivir2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyperantivir3.com (rogue)"; content:"|0d|hyperantivir3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyperantivir4.com (rogue)"; content:"|0d|hyperantivir4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyperantivir5.com (rogue)"; content:"|0d|hyperantivir5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyperantivir6.com (rogue)"; content:"|0d|hyperantivir6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idatingarena.com (crimepack)"; content:"|0c|idatingarena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iil10oil0.com (malicious)"; content:"|09|iil10oil0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilio01ili1.com (malicious)"; content:"|0a|ilio01ili1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illinoli1l.in (malicious)"; content:"|0a|illinoli1l|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img121.imageshacks.net (malware)"; content:"|06|img121|0b|imageshacks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imuliqo.info (neosploit)"; content:"|07|imuliqo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jiker.info (neosploit)"; content:"|05|jiker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jilif.info (neosploit)"; content:"|05|jilif|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jodnkism.com (zeus)"; content:"|08|jodnkism|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jqetesi.info (neosploit)"; content:"|07|jqetesi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalipsos.info (neosploit)"; content:"|08|kalipsos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanop.info (neosploit)"; content:"|05|kanop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kepep.info (neosploit)"; content:"|05|kepep|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ketrinporntube.com (trojan)"; content:"|0e|ketrinporntube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfomikyg.info (neosploit)"; content:"|08|kfomikyg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kijes.info (neosploit)"; content:"|05|kijes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kilkas.info (neosploit)"; content:"|06|kilkas|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup killer-zone.info (neosploit)"; content:"|0b|killer-zone|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kimirleonarda.info (malicious)"; content:"|0d|kimirleonarda|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knyve.info (neosploit)"; content:"|05|knyve|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kokmuang.go.th (harmful)"; content:"|08|kokmuang|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kolerty.info (neosploit)"; content:"|07|kolerty|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kopies.info (neosploit)"; content:"|06|kopies|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakihouse.info (neosploit)"; content:"|09|lakihouse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lakistar.info (neosploit)"; content:"|08|lakistar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laplandiya.info (harmful)"; content:"|0a|laplandiya|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lastyears.info (neosploit)"; content:"|09|lastyears|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liderancasindigenas.net (rogue)"; content:"|13|liderancasindigenas|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup littlemouse.info (neosploit)"; content:"|0b|littlemouse|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveinfopro.com (malware)"; content:"|0b|liveinfopro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llopos.info (neosploit)"; content:"|06|llopos|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup longtimes.info (neosploit)"; content:"|09|longtimes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lotise.com (malicious)"; content:"|06|lotise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maiamaribeihlv.info (malicious)"; content:"|0e|maiamaribeihlv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manytis.com (malicious)"; content:"|07|manytis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marguriiexyhamlin.info (malicious)"; content:"|11|marguriiexyhamlin|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketing-root.com (crimepack)"; content:"|0e|marketing-root|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcml1.com (malicious)"; content:"|05|mcml1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup membernameserver.com (malicious)"; content:"|10|membernameserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup merowa.info (neosploit)"; content:"|06|merowa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metaphorvineyards.com (rogue)"; content:"|11|metaphorvineyards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup methodsofhealing.com (crimepack)"; content:"|10|methodsofhealing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftupdateservice.com (ircbot)"; content:"|16|microsoftupdateservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mokato.com (malicious)"; content:"|06|mokato|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mokep.info (neosploit)"; content:"|05|mokep|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup monoooz41pxo.com (crimepack)"; content:"|0c|monoooz41pxo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mqutaluhy.info (neosploit)"; content:"|09|mqutaluhy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtoeufoui.info (neosploit)"; content:"|09|mtoeufoui|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzlo.info (harmful)"; content:"|05|muzlo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-best-web.com (malicious)"; content:"|0b|my-best-web|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycomputer.doublemessageupdeter.in (rogue)"; content:"|0a|mycomputer|14|doublemessageupdeter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypersonalhttp.com (rogue)"; content:"|0e|mypersonalhttp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netyr.info (neosploit)"; content:"|05|netyr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nissanmoto.ru (zeus)"; content:"|0a|nissanmoto|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitrosearch.info (malicious)"; content:"|0b|nitrosearch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nova-antivirus2.com (rogue)"; content:"|0f|nova-antivirus2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuvolokijj.com (malicious)"; content:"|0a|nuvolokijj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnotraxniki.ru (malicious)"; content:"|0c|odnotraxniki|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup official-emule.com (malware)"; content:"|0e|official-emule|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oklahomacitycom.com (malicious)"; content:"|0f|oklahomacitycom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onefogs.info (neosploit)"; content:"|07|onefogs|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onesupercars.info (neosploit)"; content:"|0c|onesupercars|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ossarix.com (malicious)"; content:"|07|ossarix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pakwer.com (malicious)"; content:"|06|pakwer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parametrer.in (crimepack)"; content:"|0a|parametrer|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phicruss.com (iframe)"; content:"|08|phicruss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup plesaxwa.com (crimepack)"; content:"|08|plesaxwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polk.in (malicious)"; content:"|04|polk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porn-tube-video.com (malicious)"; content:"|0f|porn-tube-video|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornopeace.info (malicious)"; content:"|0a|pornopeace|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornowars.info (malicious)"; content:"|09|pornowars|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntubefast.com (malicious)"; content:"|0c|porntubefast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privatetechnology.biz (malicious)"; content:"|11|privatetechnology|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qepol.info (neosploit)"; content:"|05|qepol|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rane22.it (zeus)"; content:"|06|rane22|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rdello.com (zeus)"; content:"|06|rdello|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recsaz.com (exploit)"; content:"|06|recsaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rozg.in (malicious)"; content:"|04|rozg|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruboidmon-61td.com (harmful)"; content:"|0e|ruboidmon-61td|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruralmist.ru (c&c)"; content:"|09|ruralmist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sabl.in (malicious)"; content:"|04|sabl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sadetypol.info (neosploit)"; content:"|09|sadetypol|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sadoq.info (neosploit)"; content:"|05|sadoq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sales.org.au (iframe)"; content:"|05|sales|03|org|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samk.in (malicious)"; content:"|04|samk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saqop.info (neosploit)"; content:"|05|saqop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup satyj.info (neosploit)"; content:"|05|satyj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scemo1980.no-ip.biz (malware)"; content:"|09|scemo1980|05|no-ip|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securewebmasters.com (crimepack)"; content:"|10|securewebmasters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sekmoon.net (malicious)"; content:"|07|sekmoon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sildop.com (zeus)"; content:"|06|sildop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinergy-dl.com (bot)"; content:"|0a|sinergy-dl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skachivay.com (malicious)"; content:"|09|skachivay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smackbybitch.com (malicious)"; content:"|0c|smackbybitch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smackmybitch.info (malicious)"; content:"|0c|smackmybitch|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sokam.info (trojan)"; content:"|05|sokam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solaruploader.net (trojan)"; content:"|0d|solaruploader|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soterpo.com (malicious)"; content:"|07|soterpo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stablednsstuff.com (malicious)"; content:"|0e|stablednsstuff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stepil.com (malicious)"; content:"|06|stepil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supercrazynight.com (malicious)"; content:"|0f|supercrazynight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup supersporns.com (malicious)"; content:"|0b|supersporns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superspuperporn.com (malicious)"; content:"|0f|superspuperporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-force.ru (malicious)"; content:"|09|sys-force|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syscodec.com (malicious)"; content:"|08|syscodec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup systemcodec.net (malicious)"; content:"|0b|systemcodec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup td0.ru (malicious)"; content:"|03|td0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teeging.com (zeus)"; content:"|07|teeging|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tellusforyourlife.us (zeus)"; content:"|11|tellusforyourlife|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup terop.info (neosploit)"; content:"|05|terop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theblackdogs.in (zeus)"; content:"|0c|theblackdogs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thejor.com (harmful)"; content:"|06|thejor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top5z.com (crimepack)"; content:"|05|top5z|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffcash.biz (malicious)"; content:"|09|traffcash|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trol0l0.com (malicious)"; content:"|07|trol0l0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uluwuewy.info (neosploit)"; content:"|08|uluwuewy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v-medical.org (malware)"; content:"|09|v-medical|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vawer.info (neosploit)"; content:"|05|vawer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ventureiusaj.net (zeus)"; content:"|0c|ventureiusaj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vewat.info (neosploit)"; content:"|05|vewat|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viasot.com (malicious)"; content:"|06|viasot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videosite1.com (malicious)"; content:"|0a|videosite1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viewxxxfreegall.net (malicious)"; content:"|0f|viewxxxfreegall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viiistifor1.com (malicious)"; content:"|0b|viiistifor1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vip-1117.com (neosploit)"; content:"|08|vip-1117|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viporntube.in (malware)"; content:"|0a|viporntube|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visiocarii1l.net (malicious)"; content:"|0c|visiocarii1l|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vitamelatonin.biz (c&c)"; content:"|0d|vitamelatonin|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvven.in (malicious)"; content:"|05|vvven|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wabop.info (neosploit)"; content:"|05|wabop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weaq.info (neosploit)"; content:"|04|weaq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webdiz.info (neosploit)"; content:"|06|webdiz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webentersite.com (zeus)"; content:"|0c|webentersite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websgirl.info (neosploit)"; content:"|08|websgirl|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wertyxa.info (neosploit)"; content:"|07|wertyxa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winepsy.com (malicious)"; content:"|07|winepsy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbasex.com (malicious)"; content:"|06|xbasex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xboxfreegames.com (harmful)"; content:"|0d|xboxfreegames|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xendry.info (neosploit)"; content:"|06|xendry|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xhuilil1ii.com (malicious)"; content:"|0a|xhuilil1ii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xofas.info (neosploit)"; content:"|05|xofas|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbestway.cn (malicious)"; content:"|0b|yourbestway|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youstarwars.info (neosploit)"; content:"|0b|youstarwars|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youvideoxxx.com (malicious)"; content:"|0b|youvideoxxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yrganossbas3.net (zeus)"; content:"|0c|yrganossbas3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zafet.info (neosploit)"; content:"|05|zafet|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeldaone.info (neosploit)"; content:"|08|zeldaone|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeldop.info (neosploit)"; content:"|06|zeldop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziko.in (malicious)"; content:"|04|ziko|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zingis.com (malicious)"; content:"|06|zingis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoid.in (malicious)"; content:"|04|zoid|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2020sila.com (malware)"; content:"|08|2020sila|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2pulenepro.net (malware)"; content:"|0a|2pulenepro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30zcz8ot.ru (malware)"; content:"|08|30zcz8ot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3x.ro (malware)"; content:"|02|3x|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5znhff2s.ru (malware)"; content:"|08|5znhff2s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6dpg3khy.ru (malware)"; content:"|08|6dpg3khy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7artgalery.com (malware)"; content:"|0a|7artgalery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7rtm.co.tv (malware)"; content:"|04|7rtm|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8reclame.ru (malware)"; content:"|08|8reclame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup albumfoto03.110mb.com (malware)"; content:"|0b|albumfoto03|05|110mb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allaboutc0ntrol.cc (fastflux)"; content:"|0f|allaboutc0ntrol|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allesuit.nl (malware)"; content:"|08|allesuit|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alwaysprokladka.com (malware)"; content:"|0f|alwaysprokladka|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anyscent.ru (fastflux)"; content:"|08|anyscent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqua-tops.com (fastflux)"; content:"|09|aqua-tops|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armypcscanner.com (malware)"; content:"|0d|armypcscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aroolohnet.ru (malware)"; content:"|0a|aroolohnet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ashcbzbbbz.ru (malware)"; content:"|0a|ashcbzbbbz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babihaska.net (malware)"; content:"|09|babihaska|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bakedship.ru (fastflux)"; content:"|09|bakedship|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bambambam.info (malware)"; content:"|09|bambambam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestandxast.com (malware)"; content:"|0b|bestandxast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besternax.com (malware)"; content:"|09|besternax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carroor.com (malware)"; content:"|07|carroor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cateredchaletfrankrijk.ru (malware)"; content:"|16|cateredchaletfrankrijk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crosslinks-services.ru (malware)"; content:"|13|crosslinks-services|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csokolom.ru (malware)"; content:"|08|csokolom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delete8527.cn (malicious)"; content:"|0a|delete8527|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directupdate.info (malware)"; content:"|0c|directupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolsgunss.com (fastflux)"; content:"|09|dolsgunss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domen-zaibisya.com (malware)"; content:"|0e|domen-zaibisya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drutp.com (malware)"; content:"|05|drutp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvddatadirect.com (malware)"; content:"|0d|dvddatadirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebiebi.me (malware)"; content:"|06|ebiebi|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egbvt.in (malware)"; content:"|05|egbvt|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eguyendu.com (malware)"; content:"|08|eguyendu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eplarine.com (harmful)"; content:"|08|eplarine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esvr1.ru (fastflux)"; content:"|05|esvr1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esvr2.com (fastflux)"; content:"|05|esvr2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esvr4.net (fastflux)"; content:"|05|esvr4|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filminternational.ru (fastflux)"; content:"|11|filminternational|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findergra.org (malware)"; content:"|09|findergra|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galaradio.name (malware)"; content:"|09|galaradio|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasusds.seite.es (malware)"; content:"|07|gasusds|05|seite|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gdwre766.ru (malware)"; content:"|08|gdwre766|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geavdwal.info (malware)"; content:"|08|geavdwal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerotal.info (malware)"; content:"|07|gerotal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gfgal.in (malware)"; content:"|05|gfgal|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldmemrt.info (harmful)"; content:"|09|goldmemrt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gopchicken.ru (malware)"; content:"|0a|gopchicken|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandmostik.com (malware)"; content:"|0b|grandmostik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hazelpay.ru (fastflux)"; content:"|08|hazelpay|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heroladaaw.biz (malware)"; content:"|0a|heroladaaw|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hetkwispelaartje.ru (malware)"; content:"|10|hetkwispelaartje|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgcqsf.cn (virus)"; content:"|06|hgcqsf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holiza.com (malware)"; content:"|06|holiza|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup horonili.ru (malware)"; content:"|08|horonili|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup htresq.com (malware)"; content:"|06|htresq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ic2u8kk0.ru (malware)"; content:"|08|ic2u8kk0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ielaithereej.ru (malware)"; content:"|0c|ielaithereej|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igottrafa.in (malware)"; content:"|09|igottrafa|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihjddgqs.ru (malware)"; content:"|08|ihjddgqs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indyvettes.info (malware)"; content:"|0a|indyvettes|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infostockcotv.info (malware)"; content:"|0d|infostockcotv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iodj.org (fastflux)"; content:"|04|iodj|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jongfcmp.ru (malware)"; content:"|08|jongfcmp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jujusoft.com (malware)"; content:"|08|jujusoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kldmten.net (malware)"; content:"|07|kldmten|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kojvdspw.ru (malware)"; content:"|08|kojvdspw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koliander.ru (malware)"; content:"|09|koliander|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lefamefilmacusto.com (malware)"; content:"|10|lefamefilmacusto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lipsticpi.ru (malware)"; content:"|09|lipsticpi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litend.com (harmful)"; content:"|06|litend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lopolok.ru (malware)"; content:"|07|lopolok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mafisiengo.ru (fastflux)"; content:"|0a|mafisiengo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maranello791.com (fastflux)"; content:"|0c|maranello791|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup matzines.com (malware)"; content:"|08|matzines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup meeenti.ru (malware)"; content:"|07|meeenti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mister-f.com (malware)"; content:"|08|mister-f|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modinali.com (malware)"; content:"|08|modinali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moileq.cn (malware)"; content:"|06|moileq|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mokojikol.ru (malware)"; content:"|09|mokojikol|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murrayplanthire.co.uk (malware)"; content:"|0f|murrayplanthire|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nesselandeportal.info (malware)"; content:"|10|nesselandeportal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neverreplied.in (malware)"; content:"|0c|neverreplied|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextspend.biz (fastflux)"; content:"|09|nextspend|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nyalines.com (harmful)"; content:"|08|nyalines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okiolk.ru (malware)"; content:"|06|okiolk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinefeeds.ru (malware)"; content:"|0b|onlinefeeds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinefreeze.ru (malware)"; content:"|0c|onlinefreeze|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinegop.ru (malware)"; content:"|09|onlinegop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinejobsfrees.ru (malware)"; content:"|0f|onlinejobsfrees|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinelongjorn.ru (malware)"; content:"|0e|onlinelongjorn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlineteammaster.ru (malware)"; content:"|10|onlineteammaster|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlinetechnicals.ru (malware)"; content:"|10|onlinetechnicals|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ophaeghaev.ru (fastflux)"; content:"|0a|ophaeghaev|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paleenem.com (malware)"; content:"|08|paleenem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panamais.me (malware)"; content:"|08|panamais|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paradstars.com (malware)"; content:"|0a|paradstars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup patronah.ru (malware)"; content:"|08|patronah|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perfectexe.com (malware)"; content:"|0a|perfectexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piscine-ecologique.ru (malware)"; content:"|12|piscine-ecologique|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup profanatore.com (harmful)"; content:"|0b|profanatore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projekt8.zaridi.to (harmful)"; content:"|08|projekt8|06|zaridi|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qzhvlpso.ru (malware)"; content:"|08|qzhvlpso|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rbws.duebiinformatica.it (malware)"; content:"|04|rbws|10|duebiinformatica|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realsafe-23.net (malicious)"; content:"|0b|realsafe-23|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recruitrocofinancial.com (fastflux)"; content:"|14|recruitrocofinancial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registr3red.com (malware)"; content:"|0b|registr3red|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reglasti.com (malware)"; content:"|08|reglasti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reklamen6.ru (fastflux)"; content:"|09|reklamen6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronaldknol.ru (malware)"; content:"|0a|ronaldknol|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rs206tg2.rapidshare.com (malware)"; content:"|08|rs206tg2|0a|rapidshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scaraori.com (malware)"; content:"|08|scaraori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scornar.com (malware)"; content:"|07|scornar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selavis.ru (malware)"; content:"|07|selavis|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup service2012.com (malware)"; content:"|0b|service2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simfreebox.com (malware)"; content:"|0a|simfreebox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skype36.cn (malware)"; content:"|07|skype36|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slickstage.ru (fastflux)"; content:"|0a|slickstage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smart-accountant.ru (malware)"; content:"|10|smart-accountant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t0a2afyq.ru (malware)"; content:"|08|t0a2afyq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamstream.biz (malware)"; content:"|0a|teamstream|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tipsymoon.ru (fastflux)"; content:"|09|tipsymoon|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torbuy.co.uk (malware)"; content:"|06|torbuy|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trustincompanies.ru (malware)"; content:"|10|trustincompanies|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbo-force.org (fastflux)"; content:"|0b|turbo-force|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uplcash.com (malware)"; content:"|07|uplcash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbnrte.info (malware)"; content:"|06|vbnrte|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vezda-nepuh.com (malware)"; content:"|0b|vezda-nepuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-world.biz (malware)"; content:"|0b|video-world|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vilabonanza.com.br (malware)"; content:"|0b|vilabonanza|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vinni-trinni3.net (malware)"; content:"|0d|vinni-trinni3|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westcountry.ru (fastflux)"; content:"|0b|westcountry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wiiqiieiqa.ru (malware)"; content:"|0a|wiiqiieiqa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrefraquaf.tw (malware)"; content:"|0a|wrefraquaf|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxglamour.net (malware)"; content:"|0a|xxxglamour|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yisdfgsds.seite.es (malware)"; content:"|09|yisdfgsds|05|seite|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zatuhnichmo.com (malware)"; content:"|0b|zatuhnichmo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zxcvsbrds.ru (malware)"; content:"|09|zxcvsbrds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5r.ru (malware)"; content:"|03|b5r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7p.ru (malware)"; content:"|03|b7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b9g.at (malware)"; content:"|03|b9g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1speed.info (coolwebsearch)"; content:"|06|1speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ag268.com (harmful)"; content:"|05|ag268|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ancom1.ru (malware)"; content:"|06|ancom1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0101010101010101010101010101crypt01script.com (zeus)"; content:"|29|0101010101010101010101010101crypt01script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1pulenepro.net (trojan)"; content:"|0a|1pulenepro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 64bluesphere.net (trojan)"; content:"|0c|64bluesphere|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 77quvo.com (malware)"; content:"|06|77quvo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abr.zeytincilik.info (malicious)"; content:"|03|abr|0b|zeytincilik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup absinths.com (exploitkit)"; content:"|08|absinths|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agadafrique.org (exploit)"; content:"|0b|agadafrique|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alesolo.ru (malicious)"; content:"|07|alesolo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allfilmhere.ru (malicious)"; content:"|0b|allfilmhere|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispyware-guard.com (rogue)"; content:"|11|antispyware-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywareprog.com (rogue)"; content:"|0f|antispywareprog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anzuzettelndem.com (exploit)"; content:"|0e|anzuzettelndem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquarielitgreens.com (malware)"; content:"|10|aquarielitgreens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup armyerror.ru (malicious)"; content:"|09|armyerror|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avblesk.com (rogue)"; content:"|07|avblesk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bacalavala.com.es (zeus)"; content:"|0a|bacalavala|03|com|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bailermt.com (zeus)"; content:"|08|bailermt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barfquake.ru (malicious)"; content:"|09|barfquake|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barngrape.ru (malicious)"; content:"|09|barngrape|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup berezutskii.narod.ru (exploit)"; content:"|0b|berezutskii|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bernankesoft.com (exploit)"; content:"|0c|bernankesoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestfindaloan.cn (malicious)"; content:"|0d|bestfindaloan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betafleet.ru (malicious)"; content:"|09|betafleet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bhagavatkatha.com (malware)"; content:"|0d|bhagavatkatha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigpremiumfind.cn (malicious)"; content:"|0e|bigpremiumfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigskytopguide.cn (malicious)"; content:"|0e|bigskytopguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup binpub.ru (malicious)"; content:"|06|binpub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blingfame.ru (malicious)"; content:"|09|blingfame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boatbit.ru (malicious)"; content:"|07|boatbit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bolster4235.info (trojan)"; content:"|0b|bolster4235|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boyion.ru (malicious)"; content:"|06|boyion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breadcells.ru (malicious)"; content:"|0a|breadcells|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brushmen.ru (malicious)"; content:"|08|brushmen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bugweek.ru (malicious)"; content:"|07|bugweek|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunchguide.cn (malicious)"; content:"|0a|bunchguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunda.ro (zeus)"; content:"|05|bunda|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunkleymedia.com (zeus)"; content:"|0c|bunkleymedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canmaid.ru (malicious)"; content:"|07|canmaid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinoslotgamble.cn (malicious)"; content:"|10|casinoslotgamble|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cedy.org (zeus)"; content:"|04|cedy|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup changset.com (trojan)"; content:"|08|changset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chaosscone.ru (malicious)"; content:"|0a|chaosscone|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapdrug-shop.com (malicious)"; content:"|0e|cheapdrug-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chevylaw.ru (malicious)"; content:"|08|chevylaw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup childbar.ru (malicious)"; content:"|08|childbar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chinawrap.ru (malicious)"; content:"|09|chinawrap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chispa.nu (trojan)"; content:"|06|chispa|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claimpad.ru (malicious)"; content:"|08|claimpad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claimrice.ru (malicious)"; content:"|09|claimrice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clanflag.ru (malicious)"; content:"|08|clanflag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup co-pharmacy.com (malicious)"; content:"|0b|co-pharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup co.funpic.de (suspifious)"; content:"|02|co|06|funpic|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup combinebet.cn (malicious)"; content:"|0a|combinebet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup copbun.ru (malicious)"; content:"|06|copbun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creativeblockplay.cn (malicious)"; content:"|11|creativeblockplay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup credittreport.info (malware)"; content:"|0d|credittreport|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuteflash.ru (malicious)"; content:"|09|cuteflash|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dating-4you.ru (malicious)"; content:"|0b|dating-4you|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dating-group.ru (malicious)"; content:"|0c|dating-group|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup desktop.google.com.3gsuite.net (zeus)"; content:"|07|desktop|06|google|03|com|07|3gsuite|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dingosock.ru (malicious)"; content:"|09|dingosock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discount-bestwatch.com (malicious)"; content:"|12|discount-bestwatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discount-bestwatches.com (malicious)"; content:"|14|discount-bestwatches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup discount-smartwatch.com (malicious)"; content:"|13|discount-smartwatch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain452740.com (zeus)"; content:"|0c|domain452740|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain454002.com (zeus)"; content:"|0c|domain454002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dopebank.ru (malicious)"; content:"|08|dopebank|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugbestprice.com (malicious)"; content:"|0d|drugbestprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drugs-shop4u.com (malicious)"; content:"|0c|drugs-shop4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dullcoins.ru (malicious)"; content:"|09|dullcoins|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emptyprint.ru (malicious)"; content:"|0a|emptyprint|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup entrypill.ru (malicious)"; content:"|09|entrypill|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esvr3.ru (zeus)"; content:"|05|esvr3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evilpen.ru (malicious)"; content:"|07|evilpen|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezsdo.com (malware)"; content:"|05|ezsdo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadcobra.ru (malicious)"; content:"|08|fadcobra|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fadwife.ru (malicious)"; content:"|07|fadwife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup faramandi.org (zbot)"; content:"|09|faramandi|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fightword.ru (malicious)"; content:"|09|fightword|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmera.ru (malicious)"; content:"|07|filmera|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmmir.ru (malicious)"; content:"|07|filmmir|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmriot.ru (malicious)"; content:"|08|filmriot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmsell.ru (malicious)"; content:"|08|filmsell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup filmsnake.ru (malicious)"; content:"|09|filmsnake|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigsoftpack.cn (malicious)"; content:"|0f|findbigsoftpack|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flamechild.ru (malicious)"; content:"|0a|flamechild|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foxfleet.ru (malicious)"; content:"|08|foxfleet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freaklimit.ru (malicious)"; content:"|0a|freaklimit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freecodedvd.com (trojan)"; content:"|0b|freecodedvd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frekulops.com (zeus)"; content:"|09|frekulops|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frogshair.ru (malicious)"; content:"|09|frogshair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galstorm.ru (malicious)"; content:"|08|galstorm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaposa-ng.com (trojan)"; content:"|09|gaposa-ng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geekrib.ru (malicious)"; content:"|07|geekrib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghpbmt.com (exploit)"; content:"|06|ghpbmt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup giantpremium.cn (malicious)"; content:"|0c|giantpremium|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gianttopdiscover.cn (malicious)"; content:"|10|gianttopdiscover|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gianttoplocate.cn (malicious)"; content:"|0e|gianttoplocate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigasecserver.com (malware)"; content:"|0d|gigasecserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ginmail.ru (malicious)"; content:"|07|ginmail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gizmoacid.ru (malicious)"; content:"|09|gizmoacid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldencaravela.net (zbot)"; content:"|0e|goldencaravela|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grebtiklop.com (malware)"; content:"|0a|grebtiklop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gunclown.ru (malicious)"; content:"|08|gunclown|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guygun.ru (malicious)"; content:"|06|guygun|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hairybelt.ru (malicious)"; content:"|09|hairybelt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup harpear.ru (malicious)"; content:"|07|harpear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup highstate.ru (malicious)"; content:"|09|highstate|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hillnerd.ru (malicious)"; content:"|08|hillnerd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hochutebia.ru (malicious)"; content:"|0a|hochutebia|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homecan.ru (malicious)"; content:"|07|homecan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostindianet.com (malicious)"; content:"|0c|hostindianet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotsex-meets.ru (malicious)"; content:"|0c|hotsex-meets|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsbctraffic.com (exploit)"; content:"|0b|hsbctraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hypervmsys.ru (malware)"; content:"|0a|hypervmsys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img.ranahdamai.org (trojan)"; content:"|03|img|0a|ranahdamai|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inktime.ru (malicious)"; content:"|07|inktime|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isadl.ru (zeus)"; content:"|05|isadl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isutngnd.net (zeus)"; content:"|08|isutngnd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhsfngjsdov.net (zeus)"; content:"|0b|jhsfngjsdov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jquery14.info (exploit)"; content:"|08|jquery14|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juicemilk.ru (malicious)"; content:"|09|juicemilk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kidstune.ru (malicious)"; content:"|08|kidstune|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kitegreed.ru (malicious)"; content:"|09|kitegreed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjfacebook.net (trojan)"; content:"|0a|kjfacebook|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup landclock.ru (malicious)"; content:"|09|landclock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legmood.ru (malicious)"; content:"|07|legmood|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightkeys.ru (malicious)"; content:"|09|lightkeys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limitgap.ru (malicious)"; content:"|08|limitgap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linux1980.homepc.it (zeus)"; content:"|09|linux1980|06|homepc|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lipspig.ru (malicious)"; content:"|07|lipspig|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup litetopfindworld.cn (malicious)"; content:"|10|litetopfindworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup live-pharmacy.com (malicious)"; content:"|0d|live-pharmacy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lkgjhjbh.balkansport.info (malicious)"; content:"|08|lkgjhjbh|0b|balkansport|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup locoblock.ru (malicious)"; content:"|09|locoblock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lossplant.ru (malicious)"; content:"|09|lossplant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup love-pair.ru (malicious)"; content:"|09|love-pair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup luckyfilth.ru (malicious)"; content:"|0a|luckyfilth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lumpybell.ru (malicious)"; content:"|09|lumpybell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lumpysmell.ru (malicious)"; content:"|0a|lumpysmell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lunchego.ru (malicious)"; content:"|08|lunchego|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabilo.com (malware)"; content:"|06|mabilo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malecold.ru (malicious)"; content:"|08|malecold|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastaace.ag (zeus)"; content:"|08|mastaace|02|ag"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mealsmell.ru (malicious)"; content:"|09|mealsmell|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediahousenamebuypicture.cn (malicious)"; content:"|18|mediahousenamebuypicture|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup melatocasotravez.in (zeus)"; content:"|10|melatocasotravez|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup micarea.ru (malicious)"; content:"|07|micarea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup michaelsbestway2findalawyer.cn (malicious)"; content:"|1b|michaelsbestway2findalawyer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mildbabe.ru (malicious)"; content:"|08|mildbabe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momhand.ru (malicious)"; content:"|07|momhand|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mooddeal.ru (malicious)"; content:"|08|mooddeal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moodwater.ru (malicious)"; content:"|09|moodwater|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mudbaby.ru (malicious)"; content:"|07|mudbaby|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mushyoil.ru (malicious)"; content:"|08|mushyoil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicnut.ru (malicious)"; content:"|08|musicnut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musicspark.ru (malicious)"; content:"|0a|musicspark|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylivejournalchanel.com (harmful)"; content:"|13|mylivejournalchanel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netwebinternet.ru (malicious)"; content:"|0e|netwebinternet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newnetnameshop.cn (malicious)"; content:"|0e|newnetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpoem.ru (malicious)"; content:"|07|newpoem|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextstage.me (zeus)"; content:"|09|nextstage|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nextstage.zapto.org (zeus)"; content:"|09|nextstage|05|zapto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns1.bestservicehost.com (malicious)"; content:"|03|ns1|0f|bestservicehost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nxo48a7g.ru (trojan)"; content:"|08|nxo48a7g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oashae2ieyek.ru (zeus)"; content:"|0c|oashae2ieyek|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnoklassniki-nochiu.ru (malicious)"; content:"|14|odnoklassniki-nochiu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup odnoklassnikinochiu.ru (malicious)"; content:"|13|odnoklassnikinochiu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onionfleet.ru (malicious)"; content:"|0a|onionfleet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opentruck.ru (malicious)"; content:"|09|opentruck|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup packimage.ru (malicious)"; content:"|09|packimage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parkinglotbet.cn (malicious)"; content:"|0d|parkinglotbet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup party-images.net (malware)"; content:"|0c|party-images|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup partymoney.ru (malicious)"; content:"|0a|partymoney|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pearlring.ru (malicious)"; content:"|09|pearlring|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pearlrisk.ru (malicious)"; content:"|09|pearlrisk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pegamp.ru (malicious)"; content:"|06|pegamp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pendude.ru (malicious)"; content:"|07|pendude|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pharmacy-magazine.com (malicious)"; content:"|11|pharmacy-magazine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planeshoes.ru (malicious)"; content:"|0a|planeshoes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planet-of-sexy.ru (malicious)"; content:"|0e|planet-of-sexy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup planet-sexy.ru (malicious)"; content:"|0b|planet-sexy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playslotbet.cn (malicious)"; content:"|0b|playslotbet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poolshirt.ru (malicious)"; content:"|09|poolshirt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup poorweb.ru (malicious)"; content:"|07|poorweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntube-nowx.com (rogue)"; content:"|0d|porntube-nowx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porsche911start.ru (malware)"; content:"|0f|porsche911start|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup powermixplay.cn (malicious)"; content:"|0c|powermixplay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup premiumlocate.cn (malicious)"; content:"|0d|premiumlocate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promojoyswif.net (zbot)"; content:"|0c|promojoyswif|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q0x.in (malicious)"; content:"|03|q0x|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q5x.ru (malicious)"; content:"|03|q5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup queryiron.ru (malicious)"; content:"|09|queryiron|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup questwidow.ru (malicious)"; content:"|0a|questwidow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rackcells.ru (malicious)"; content:"|09|rackcells|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radarmaze.ru (malicious)"; content:"|09|radarmaze|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup radioquest.ru (malicious)"; content:"|0a|radioquest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rawware.ru (malicious)"; content:"|07|rawware|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realyear.ru (malicious)"; content:"|08|realyear|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richav.net (rogue)"; content:"|06|richav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rimpearl.ru (malicious)"; content:"|08|rimpearl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ripejoke.ru (malicious)"; content:"|08|ripejoke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rise-soft.info (rogue)"; content:"|09|rise-soft|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riskvenom.ru (malicious)"; content:"|09|riskvenom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rockbale.ru (malicious)"; content:"|08|rockbale|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ropefad.ru (malicious)"; content:"|07|ropefad|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roseshow.ru (malicious)"; content:"|08|roseshow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rowhock.ru (malicious)"; content:"|07|rowhock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rtsantivirus2010.com (rogue)"; content:"|10|rtsantivirus2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rubylips.ru (malicious)"; content:"|08|rubylips|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samocity-fr.co.cc (backdoor)"; content:"|0b|samocity-fr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scaryrack.ru (malicious)"; content:"|09|scaryrack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdfasdf.vangangelt.info (malicious)"; content:"|07|sdfasdf|0a|vangangelt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seksyplanet.ru (malicious)"; content:"|0b|seksyplanet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seksyy-planet.ru (malicious)"; content:"|0d|seksyy-planet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seksyyplanet.ru (malicious)"; content:"|0c|seksyyplanet|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup setofdata.com (trojan)"; content:"|09|setofdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sheepfork.ru (malicious)"; content:"|09|sheepfork|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shinyfrogs.ru (malicious)"; content:"|0a|shinyfrogs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shipfink.ru (malicious)"; content:"|08|shipfink|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirleybarbers.com (exploit)"; content:"|0e|shirleybarbers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirtband.ru (malicious)"; content:"|09|shirtband|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirtcoins.ru (malicious)"; content:"|0a|shirtcoins|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shoesrebel.ru (malicious)"; content:"|0a|shoesrebel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortcafe.ru (malicious)"; content:"|09|shortcafe|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup showarms.ru (malicious)"; content:"|08|showarms|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sillyfame.ru (malicious)"; content:"|09|sillyfame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sixthdoor.ru (malicious)"; content:"|09|sixthdoor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slavetube.ru (malicious)"; content:"|09|slavetube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sledhour.ru (malicious)"; content:"|08|sledhour|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonnose.ru (malicious)"; content:"|07|sonnose|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup splitssoft.com (exploit)"; content:"|0a|splitssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spoonsled.ru (malicious)"; content:"|09|spoonsled|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spotthing.ru (malicious)"; content:"|09|spotthing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stallnut.ru (malicious)"; content:"|08|stallnut|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statebot.ru (malicious)"; content:"|08|statebot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strange-im-blocked.info (phishing)"; content:"|12|strange-im-blocked|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stuffcorn.ru (malicious)"; content:"|09|stuffcorn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sublover.ru (malicious)"; content:"|08|sublover|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sumerki-ztmenie.ru (malicious)"; content:"|0f|sumerki-ztmenie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superedge.ru (malicious)"; content:"|09|superedge|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t8hftjx8.ru (trojan)"; content:"|08|t8hftjx8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talldeed.ru (malicious)"; content:"|08|talldeed|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxesball.ru (malicious)"; content:"|09|taxesball|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxestower.ru (malicious)"; content:"|0a|taxestower|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup termquake.ru (malicious)"; content:"|09|termquake|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup the-day-after-tomorrow-2.ru (malicious)"; content:"|18|the-day-after-tomorrow-2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebestwaytofind.cn (malicious)"; content:"|10|thebestwaytofind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thecutpricegroup.cn (malicious)"; content:"|10|thecutpricegroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theirsnot.ru (malicious)"; content:"|09|theirsnot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thirdharp.ru (malicious)"; content:"|09|thirdharp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup towersky.ru (malicious)"; content:"|08|towersky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treetip.ru (malicious)"; content:"|07|treetip|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trfistc.info (harmful)"; content:"|07|trfistc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup typeforman.net (exploit)"; content:"|0a|typeforman|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tytowax.info (exploit)"; content:"|07|tytowax|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utomlennie-solncem-2.ru (malicious)"; content:"|14|utomlennie-solncem-2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video.fbookarchive.com (exploit)"; content:"|05|video|0c|fbookarchive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vip-1127.com (rogue)"; content:"|08|vip-1127|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vparimvam.info (malware)"; content:"|09|vparimvam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvmmp.ru (zeus)"; content:"|05|vvmmp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvvne.in (exploit)"; content:"|05|vvvne|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warydrunk.ru (malicious)"; content:"|09|warydrunk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watch-atbestprice.com (malicious)"; content:"|11|watch-atbestprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchatlowprice.com (malicious)"; content:"|0f|watchatlowprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup waxytooth.ru (malicious)"; content:"|09|waxytooth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weedsea.ru (malicious)"; content:"|07|weedsea|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weekrack.ru (malicious)"; content:"|08|weekrack|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup widescone.ru (malicious)"; content:"|09|widescone|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wormware.ru (malicious)"; content:"|08|wormware|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrapboss.ru (malicious)"; content:"|08|wrapboss|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdk1gmax.com (exploit)"; content:"|08|xdk1gmax|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmtra.info (harmful)"; content:"|05|xmtra|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmtrb.info (harmful)"; content:"|05|xmtrb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xochu-dating.ru (malicious)"; content:"|0c|xochu-dating|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup you2323.net (trojan)"; content:"|07|you2323|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbettas.cn (malicious)"; content:"|0a|yourbettas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zenrope.ru (malicious)"; content:"|07|zenrope|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zinceye.ru (malicious)"; content:"|07|zinceye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoojeans.ru (malicious)"; content:"|08|zoojeans|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 168ss.com (trojan)"; content:"|05|168ss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2112111.com (harmful)"; content:"|07|2112111|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 97bao.info (harmful)"; content:"|05|97bao|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aabgjzeavmr.com (malware)"; content:"|0b|aabgjzeavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abcjpafamlc.com (malware)"; content:"|0b|abcjpafamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdeunbamlc.com (malware)"; content:"|0b|acdeunbamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdoujlamlc.com (malware)"; content:"|0b|acdoujlamlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefuohsavmr.com (malware)"; content:"|0b|aefuohsavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aefuotsavmr.com (malware)"; content:"|0b|aefuotsavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghrcapavmr.com (malware)"; content:"|0b|aghrcapavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghrcdpafir.com (malware)"; content:"|0b|aghrcdpafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghrcgpavmr.com (malware)"; content:"|0b|aghrcgpavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghrcppafir.com (malware)"; content:"|0b|aghrcppafir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ajieaacavmr.com (malware)"; content:"|0b|ajieaacavmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup asyyvykn.com (exploit)"; content:"|08|asyyvykn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner30-pd.co.cc (scareware)"; content:"|0e|avcleaner30-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner31-pd.co.cc (harmful)"; content:"|0e|avcleaner31-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner32-pd.co.cc (scareware)"; content:"|0e|avcleaner32-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner33-pd.co.cc (harmful)"; content:"|0e|avcleaner33-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner34-pd.co.cc (scareware)"; content:"|0e|avcleaner34-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner35-pd.co.cc (scareware)"; content:"|0e|avcleaner35-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner36-pd.co.cc (harmful)"; content:"|0e|avcleaner36-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner37-pd.co.cc (harmful)"; content:"|0e|avcleaner37-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner38-pd.co.cc (scareware)"; content:"|0e|avcleaner38-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner39-pd.co.cc (scareware)"; content:"|0e|avcleaner39-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avcleaner40-pd.co.cc (scareware)"; content:"|0e|avcleaner40-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscaner-34pr.co.cc (rogue)"; content:"|0d|avscaner-34pr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscaner-40pr.co.cc (scareware)"; content:"|0d|avscaner-40pr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ayuorning.com (exploit)"; content:"|09|ayuorning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbccrhabfir.com (malware)"; content:"|0b|bbccrhabfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bettingmarket.com (exploit)"; content:"|0d|bettingmarket|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bfgvsjtbfir.com (harmful)"; content:"|0b|bfgvsjtbfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizaue.com (trojan)"; content:"|06|bizaue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cefbfoxcmlc.com (malware)"; content:"|0b|cefbfoxcmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup check-saveyour-pc-now.in (scareware)"; content:"|15|check-saveyour-pc-now|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup confinig.com (exploit)"; content:"|08|confinig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyuihenoyydb.com (exploit)"; content:"|0c|cyuihenoyydb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup davirijan.cn (rogue)"; content:"|09|davirijan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbcdpiadmlc.com (exploit)"; content:"|0b|dbcdpiadmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddeyfewdvmr.com (harmful)"; content:"|0b|ddeyfewdvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diaptdndvmr.com (harmful)"; content:"|0b|diaptdndvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donrart55-td.co.cc (scareware)"; content:"|0c|donrart55-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donrart57-td.co.cc (scareware)"; content:"|0c|donrart57-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup donrart59-td.co.cc (scareware)"; content:"|0c|donrart59-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebcnpekemlc.com (malware)"; content:"|0b|ebcnpekemlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eghjpbfemlc.com (harmful)"; content:"|0b|eghjpbfemlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favoritav30-pd.co.cc (scareware)"; content:"|0e|favoritav30-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favoritav34-pd.co.cc (scareware)"; content:"|0e|favoritav34-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favoritav36-pd.co.cc (scareware)"; content:"|0e|favoritav36-pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findmyhost.com (exploit)"; content:"|0a|findmyhost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash-video.co.tv (fake_codec)"; content:"|0b|flash-video|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-guard.com (scareware)"; content:"|0a|free-guard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-guard.net (scareware)"; content:"|0a|free-guard|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funnypictures.dk (exploit)"; content:"|0d|funnypictures|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gccmimxtuf.com (malware)"; content:"|0a|gccmimxtuf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geglete.cn (trojan)"; content:"|07|geglete|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geqamuvuy.cn (harmful)"; content:"|09|geqamuvuy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gghbtyagthr.com (malware)"; content:"|0b|gghbtyagthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodguardz.com (scareware)"; content:"|0a|goodguardz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analytics.dynalias.org (malware)"; content:"|10|google-analytics|08|dynalias|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatav40-td.co.cc (scareware)"; content:"|0c|greatav40-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hackenmsn.nl (harmful)"; content:"|09|hackenmsn|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hibatavay.cn (rogue)"; content:"|09|hibatavay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup holaamerica.tv (exploit)"; content:"|0b|holaamerica|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hqcqyqlktsg.com (malware)"; content:"|0b|hqcqyqlktsg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icq4all.net (exploit)"; content:"|07|icq4all|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imhatoper.com (malware)"; content:"|09|imhatoper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in-safe-keepmyzone.in (scareware)"; content:"|12|in-safe-keepmyzone|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irsqrmerthtf.com (malware)"; content:"|0c|irsqrmerthtf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iujizui.freeo.net (exploit)"; content:"|07|iujizui|05|freeo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwaonaffvdzc.com (malware)"; content:"|0c|iwaonaffvdzc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jabmkeijmlc.com (malware)"; content:"|0b|jabmkeijmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jghcroajvmr.com (malware)"; content:"|0b|jghcroajvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jghmhhkjvmr.com (malware)"; content:"|0b|jghmhhkjvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjikachjmlc.com (malware)"; content:"|0b|jjikachjmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justsoft11-td.co.cc (scareware)"; content:"|0d|justsoft11-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup justsoft12-td.co.cc (scareware)"; content:"|0d|justsoft12-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khjeuebkmlc.com (malware)"; content:"|0b|khjeuebkmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiaedmdkthr.com (malware)"; content:"|0b|kiaedmdkthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup land-protection.com (scareware)"; content:"|0f|land-protection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mainguard33-pr.co.cc (rogue)"; content:"|0e|mainguard33-pr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makesafe-scan-forsure.com (scareware)"; content:"|15|makesafe-scan-forsure|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manushta.com (trojan)"; content:"|08|manushta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcdiuogmmlc.com (malware)"; content:"|0b|mcdiuogmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfgfgcemthr.com (malware)"; content:"|0b|mfgfgcemthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfgubztmthr.com (harmful)"; content:"|0b|mfgubztmthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millo.niztyc.net (exploit)"; content:"|05|millo|06|niztyc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miymiy3.com (scareware)"; content:"|07|miymiy3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjifadcmmlc.com (harmful)"; content:"|0b|mjifadcmmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moyshi.com (exploit)"; content:"|06|moyshi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nameishera.info (trojan)"; content:"|0a|nameishera|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup niakyljnvmr.com (malware)"; content:"|0b|niakyljnvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nje0.cn (harmful)"; content:"|04|nje0|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nje1.cn (harmful)"; content:"|04|nje1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ockvfsqtbkm.com (malware)"; content:"|0b|ockvfsqtbkm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oghxphuomlc.com (malware)"; content:"|0b|oghxphuomlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup old-crash.com (trojan)"; content:"|09|old-crash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oljalhjakcs.com (malware)"; content:"|0b|oljalhjakcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pfgldfipfir.com (malware)"; content:"|0b|pfgldfipfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup piaptdnpfir.com (malware)"; content:"|0b|piaptdnpfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-helper.com (scareware)"; content:"|0e|protect-helper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect-zone.com (scareware)"; content:"|0c|protect-zone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectzone.net (scareware)"; content:"|0b|protectzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qabqxdoqfir.com (malware)"; content:"|0b|qabqxdoqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcirevsxgogk.com (malware)"; content:"|0c|qcirevsxgogk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qefuohsqfir.com (malware)"; content:"|0b|qefuohsqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghcroaqfir.com (malware)"; content:"|0b|qghcroaqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghmhwkqfir.com (malware)"; content:"|0b|qghmhwkqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjieaicqfir.com (exploit)"; content:"|0b|qjieaicqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qjitkkrqfir.com (exploit)"; content:"|0b|qjitkkrqfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recordtdms.com (malware)"; content:"|0a|recordtdms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rfgvsutrvmr.com (malware)"; content:"|0b|rfgvsutrvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riakyljrfir.com (malware)"; content:"|0b|riakyljrfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riaptfnrvmr.com (zeus)"; content:"|0b|riaptfnrvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ripubcc.com (trojan)"; content:"|07|ripubcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ro1.wro3.com (trojan)"; content:"|03|ro1|04|wro3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robints.us (harmful)"; content:"|07|robints|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rotabannerincominggoogleyandex.com (exploit)"; content:"|1e|rotabannerincominggoogleyandex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rqqxiwdexgz.com (exploit)"; content:"|0b|rqqxiwdexgz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sapewixis.cn (rogue)"; content:"|09|sapewixis|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scxgw.com (exploit)"; content:"|05|scxgw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup securitymasterav.com (scareware)"; content:"|10|securitymasterav|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sefojqnsthr.com (malware)"; content:"|0b|sefojqnsthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sghnpnksmlc.com (harmful)"; content:"|0b|sghnpnksmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shjmcmlsthr.com (malware)"; content:"|0b|shjmcmlsthr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunnydeal.net (trojan)"; content:"|09|sunnydeal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swintermz.cz.cc (scareware)"; content:"|09|swintermz|02|cz|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tagmjhjlfhlo.com (harmful)"; content:"|0c|tagmjhjlfhlo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taogu.org.cn (harmful)"; content:"|05|taogu|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tg250.com.cn (harmful)"; content:"|05|tg250|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup torrentreactor.to (exploit)"; content:"|0e|torrentreactor|02|to"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafallbest.com (exploit)"; content:"|0b|trafallbest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trytocleanit-36p.co.cc (scareware)"; content:"|10|trytocleanit-36p|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tvbpcsyiipe.com (exploit)"; content:"|0b|tvbpcsyiipe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup udefapcumlc.com (harmful)"; content:"|0b|udefapcumlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ujiaafwumlc.com (malware)"; content:"|0b|ujiaafwumlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ursagates.co.uk (exploit)"; content:"|09|ursagates|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup useguard.com (scareware)"; content:"|08|useguard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ut885.com (exploit)"; content:"|05|ut885|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vbcrctpvvmr.com (malware)"; content:"|0b|vbcrctpvvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdeyfowvfir.com (malware)"; content:"|0b|vdeyfowvfir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdeyftwvvmr.com (malware)"; content:"|0b|vdeyftwvvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vfgvsttvvmr.com (malware)"; content:"|0b|vfgvsttvvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vhjeudbvmlc.com (harmful)"; content:"|0b|vhjeudbvmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vhjjqqgvvmr.com (harmful)"; content:"|0b|vhjjqqgvvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viabfvxvmlc.com (malware)"; content:"|0b|viabfvxvmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezgarden.com (exploit)"; content:"|0b|warezgarden|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wesdarter.com (trojan)"; content:"|09|wesdarter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weyefakov.cn (harmful)"; content:"|09|weyefakov|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsystemupdates.com (scareware)"; content:"|10|winsystemupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdefaocxmlc.com (exploit)"; content:"|0b|xdefaocxmlc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdeoppmxvmr.com (exploit)"; content:"|0b|xdeoppmxvmr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxxxkdjkfjskdfjlskdjf.com (rogue)"; content:"|16|xxxxxkdjkfjskdfjlskdjf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yteqbqtuuuev.com (exploit)"; content:"|0c|yteqbqtuuuev|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zgrrwdpsggz.com (exploit)"; content:"|0b|zgrrwdpsggz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zoneguardland.com (scareware)"; content:"|0d|zoneguardland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myb88.com (exploit)"; content:"|05|myb88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1classfilter.be (scareware)"; content:"|0c|1classfilter|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1ip5p8h.co.cc (scareware)"; content:"|07|1ip5p8h|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1us51n.co.cc (scareware)"; content:"|06|1us51n|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 24shopping.nl (scareware)"; content:"|0a|24shopping|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 770304123.cn (risk)"; content:"|09|770304123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2615255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9mama.pl (scareware)"; content:"|05|9mama|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaoutdoors.com (zeus)"; content:"|0a|aaoutdoors|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdaovvaoxk.com (malicious)"; content:"|0b|acdaovvaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup action-force.net (scareware)"; content:"|0c|action-force|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup actionsdefence.com (harmful)"; content:"|0e|actionsdefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aifmydpuhv.co.cc (scareware)"; content:"|0a|aifmydpuhv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amquijycpntb.co.cc (scareware)"; content:"|0c|amquijycpntb|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anytimeopen.com (scareware)"; content:"|0b|anytimeopen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apwireless.ca (scareware)"; content:"|0a|apwireless|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqejhilmvb.co.cc (scareware)"; content:"|0a|aqejhilmvb|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arnepqjya.co.cc (scareware)"; content:"|09|arnepqjya|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atomizer.net (scareware)"; content:"|08|atomizer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avmarket.com.ua (scareware)"; content:"|08|avmarket|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babah20122012.com (iframe)"; content:"|0d|babah20122012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baby-car.ru (scareware)"; content:"|08|baby-car|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babystart.eu (scareware)"; content:"|09|babystart|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup badlhby.com (scareware)"; content:"|07|badlhby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bazarnet.com.mx (scareware)"; content:"|08|bazarnet|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bead.shop-in-hk.com (scareware)"; content:"|04|bead|0a|shop-in-hk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bekqjcra.co.cc (scareware)"; content:"|08|bekqjcra|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benyd.co.cc (scareware)"; content:"|05|benyd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestdesision.co.cc (scareware)"; content:"|0c|bestdesision|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestgreatarts.com (scareware)"; content:"|0d|bestgreatarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz1.co.cc (harmful)"; content:"|0b|bestsavezz1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz2.co.cc (harmful)"; content:"|0b|bestsavezz2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz3.co.cc (harmful)"; content:"|0b|bestsavezz3|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz4.co.cc (harmful)"; content:"|0b|bestsavezz4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz5.co.cc (harmful)"; content:"|0b|bestsavezz5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz6.co.cc (harmful)"; content:"|0b|bestsavezz6|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz7.co.cc (harmful)"; content:"|0b|bestsavezz7|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz8.co.cc (harmful)"; content:"|0b|bestsavezz8|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestsavezz9.co.cc (harmful)"; content:"|0b|bestsavezz9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestseller4you.at (scareware)"; content:"|0e|bestseller4you|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biberhapiturkiye.org (harmful)"; content:"|10|biberhapiturkiye|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bicigrino.info (scareware)"; content:"|09|bicigrino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bilgininefendisi.net (harmful)"; content:"|10|bilgininefendisi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bipilyqomyusvuhy.co.cc (scareware)"; content:"|10|bipilyqomyusvuhy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bjalumericz.co.cc (scareware)"; content:"|0b|bjalumericz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bridezion.de (scareware)"; content:"|09|bridezion|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buenapetito.net (scareware)"; content:"|0b|buenapetito|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butikk.losnaspelet.no (scareware)"; content:"|06|butikk|0b|losnaspelet|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup calicompras.com (scareware)"; content:"|0b|calicompras|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup candjconsulting.us (scareware)"; content:"|0f|candjconsulting|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casacristorey.com.mx (scareware)"; content:"|0d|casacristorey|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccanlitv.com (exploit)"; content:"|08|ccanlitv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chammaope.co.cc (scareware)"; content:"|09|chammaope|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheekybrats.com.au (scareware)"; content:"|0b|cheekybrats|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chiri-junior.nl (scareware)"; content:"|0c|chiri-junior|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cloudisthebestnow.com (hack)"; content:"|11|cloudisthebestnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clubshirts.info (scareware)"; content:"|0a|clubshirts|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coebfjqmkhsn.co.cc (scareware)"; content:"|0c|coebfjqmkhsn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup comp-s.co.cc (scareware)"; content:"|06|comp-s|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup companions411.biz (scareware)"; content:"|0d|companions411|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corporate-pc.com (scareware)"; content:"|0c|corporate-pc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deesis.com.pl (scareware)"; content:"|06|deesis|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derise.ee (scareware)"; content:"|06|derise|02|ee"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalelectronicsolutions.biz (scareware)"; content:"|1a|digitalelectronicsolutions|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dj1stop.com (scareware)"; content:"|07|dj1stop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnfwg.bz (harmful)"; content:"|05|dnfwg|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easfindnex.org (malicious)"; content:"|0a|easfindnex|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eatmyshortsforever.info (zeus)"; content:"|12|eatmyshortsforever|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup egeoptik.com (scareware)"; content:"|08|egeoptik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eglash.com (malware)"; content:"|06|eglash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eshop.mr-servis.cz (scareware)"; content:"|05|eshop|09|mr-servis|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evage.biz (scareware)"; content:"|05|evage|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eventhorizon.biz (scareware)"; content:"|0c|eventhorizon|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eynuqacjrtiz.co.cc (scareware)"; content:"|0c|eynuqacjrtiz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feit23.com (fastflux)"; content:"|06|feit23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findermar.org (malicious)"; content:"|09|findermar|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findrasup.org (malicious)"; content:"|09|findrasup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firsaturunlerim.com (scareware)"; content:"|0f|firsaturunlerim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fliq.de (scareware)"; content:"|04|fliq|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freestyle-shop.ch (scareware)"; content:"|0e|freestyle-shop|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gameartisans.org (scareware)"; content:"|0c|gameartisans|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup games520.cn (malware)"; content:"|08|games520|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gawex.com.pl (scareware)"; content:"|05|gawex|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gct.ro (scareware)"; content:"|03|gct|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gentian.no (scareware)"; content:"|07|gentian|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geraeuschwelten.de (scareware)"; content:"|0f|geraeuschwelten|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getmoney4me.co.cc (scareware)"; content:"|0b|getmoney4me|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gomytds.com (harmful)"; content:"|07|gomytds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goumucnypuxuhyikzi.co.cc (scareware)"; content:"|12|goumucnypuxuhyikzi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guihua.com.hk (scareware)"; content:"|06|guihua|03|com|02|hk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hdegalchoxk.com (harmful)"; content:"|0b|hdegalchoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiokirygohxinugohu.co.cc (scareware)"; content:"|12|hiokirygohxinugohu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hryjhuklo.co.cc (scareware)"; content:"|09|hryjhuklo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huafeichzh1002.com (risk)"; content:"|0e|huafeichzh1002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hydromasaze.com (scareware)"; content:"|0b|hydromasaze|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ibdumycp.co.cc (scareware)"; content:"|08|ibdumycp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ideazzz.ru (scareware)"; content:"|07|ideazzz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifohviwihuuxitqoil.co.cc (scareware)"; content:"|12|ifohviwihuuxitqoil|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ifyfgybyuxisoffu.co.cc (scareware)"; content:"|10|ifyfgybyuxisoffu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ignitionlb.info (scareware)"; content:"|0a|ignitionlb|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ihquyrvutyridyuwyj.co.cc (scareware)"; content:"|12|ihquyrvutyridyuwyj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ijojinhuxifykygysu.co.cc (scareware)"; content:"|12|ijojinhuxifykygysu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imalaya.eu (scareware)"; content:"|07|imalaya|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imdjrsfybnav.co.cc (scareware)"; content:"|0c|imdjrsfybnav|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup incom-sale.co.cc (scareware)"; content:"|0a|incom-sale|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indextech.info (zeus)"; content:"|09|indextech|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indextechnology.info (zeus)"; content:"|0f|indextechnology|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indovic.net (scareware)"; content:"|07|indovic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoshok.info (malicious)"; content:"|08|infoshok|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inoltoumydonulijuk.co.cc (scareware)"; content:"|12|inoltoumydonulijuk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inselfdefence.com (harmful)"; content:"|0d|inselfdefence|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranagrishop.com (scareware)"; content:"|0c|iranagrishop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iroqimcuohubizgooh.co.cc (scareware)"; content:"|12|iroqimcuohubizgooh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irpen.biz (scareware)"; content:"|05|irpen|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irstnationarts.com (scareware)"; content:"|0e|irstnationarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup issanni.net (scareware)"; content:"|07|issanni|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwanti.co.cc (scareware)"; content:"|06|iwanti|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iyqvogx.co.cc (scareware)"; content:"|07|iyqvogx|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jasoncorrick.co.uk (scareware)"; content:"|0c|jasoncorrick|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jepabhto.co.cc (scareware)"; content:"|08|jepabhto|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadin21.com (harmful)"; content:"|07|kadin21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiaxmh4.co.cc (scareware)"; content:"|07|kiaxmh4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiboinikixuvquliro.co.cc (scareware)"; content:"|12|kiboinikixuvquliro|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klimuszko.net (scareware)"; content:"|09|klimuszko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krasevka.si (scareware)"; content:"|08|krasevka|02|si"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krclear.com (malicious)"; content:"|07|krclear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krghiqyiht.co.cc (scareware)"; content:"|0a|krghiqyiht|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kundalinibooks.com.au (scareware)"; content:"|0e|kundalinibooks|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kuub.com (scareware)"; content:"|04|kuub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kyogpylymypusulojo.co.cc (scareware)"; content:"|12|kyogpylymypusulojo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lanpower.se (scareware)"; content:"|08|lanpower|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leathershop.be (scareware)"; content:"|0b|leathershop|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lojavirtual.versameta.pt (scareware)"; content:"|0b|lojavirtual|09|versameta|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltcsi0.co.cc (scareware)"; content:"|06|ltcsi0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ludf.net (scareware)"; content:"|04|ludf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup machineinterface.net (scareware)"; content:"|10|machineinterface|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marinestores.biz (scareware)"; content:"|0c|marinestores|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microdermals.com (scareware)"; content:"|0c|microdermals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mikhailriubertsov.com (malicious)"; content:"|11|mikhailriubertsov|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mingfai.info (scareware)"; content:"|07|mingfai|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minitar.com.tw (scareware)"; content:"|07|minitar|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup movieartsworld.com (scareware)"; content:"|0e|movieartsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msproductions.be (scareware)"; content:"|0d|msproductions|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup murgiaintavola.it (scareware)"; content:"|0e|murgiaintavola|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvchorus.org (scareware)"; content:"|08|mvchorus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nethealthcarego.com (harmful)"; content:"|0f|nethealthcarego|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettohoffnung.de (scareware)"; content:"|0d|nettohoffnung|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nitmail.com (scareware)"; content:"|07|nitmail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup olek.co.uk (scareware)"; content:"|04|olek|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omsuimuhysjoujiqip.co.cc (scareware)"; content:"|12|omsuimuhysjoujiqip|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opco.co.ir (scareware)"; content:"|04|opco|02|co|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opimuzxiyrxigoiwur.co.cc (scareware)"; content:"|12|opimuzxiyrxigoiwur|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opliyng.com (iframe)"; content:"|07|opliyng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostozuorypofitjuti.co.cc (scareware)"; content:"|12|ostozuorypofitjuti|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pahomefinance.net (scareware)"; content:"|0d|pahomefinance|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paketic.com (scareware)"; content:"|07|paketic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parisa.lt (scareware)"; content:"|06|parisa|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcmall.ro (scareware)"; content:"|06|pcmall|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pentruacasa.com (scareware)"; content:"|0b|pentruacasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pqusrzycd.co.cc (scareware)"; content:"|09|pqusrzycd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promotechmexico.com.mx (scareware)"; content:"|0f|promotechmexico|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prozoomhosting.net (scareware)"; content:"|0e|prozoomhosting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptvibnrjeayh.co.cc (scareware)"; content:"|0c|ptvibnrjeayh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pubaxj.co.cc (scareware)"; content:"|06|pubaxj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pucrsnihoqy.co.cc (scareware)"; content:"|0b|pucrsnihoqy|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pursuitspt1.com (scareware)"; content:"|0b|pursuitspt1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qbhomskuine.co.cc (scareware)"; content:"|0b|qbhomskuine|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcumoyh.co.cc (scareware)"; content:"|07|qcumoyh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quadroufo.com (scareware)"; content:"|09|quadroufo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quecumbar.co.uk (scareware)"; content:"|09|quecumbar|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qyczejdlita.co.cc (scareware)"; content:"|0b|qyczejdlita|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcchina.com.cn (scareware)"; content:"|07|rcchina|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realcleaner23p.co.cc (rogue)"; content:"|0e|realcleaner23p|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recoverinstyle.net (scareware)"; content:"|0e|recoverinstyle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relogio-de-ponto.com.pt (scareware)"; content:"|10|relogio-de-ponto|03|com|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rhodiola.com.mx (scareware)"; content:"|08|rhodiola|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ridcamybv.co.cc (scareware)"; content:"|09|ridcamybv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rithubmolnda.co.cc (scareware)"; content:"|0c|rithubmolnda|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup riyvroiqfoydcilifo.co.cc (scareware)"; content:"|12|riyvroiqfoydcilifo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rnoqzydjuia.co.cc (scareware)"; content:"|0b|rnoqzydjuia|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rotas.lt (scareware)"; content:"|05|rotas|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rpdkjuaft.co.cc (scareware)"; content:"|09|rpdkjuaft|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rybidlzck.co.cc (scareware)"; content:"|09|rybidlzck|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryliydulivuvdojo.co.cc (scareware)"; content:"|10|ryliydulivuvdojo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rywutydymoxyodygyt.co.cc (scareware)"; content:"|12|rywutydymoxyodygyt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sammlereck.info (scareware)"; content:"|0a|sammlereck|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdemfjotuc.co.cc (scareware)"; content:"|0a|sdemfjotuc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup search-portal.co.cc (scareware)"; content:"|0d|search-portal|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sensicacciaepesca.com (scareware)"; content:"|11|sensicacciaepesca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shopzone.ir (scareware)"; content:"|08|shopzone|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sink-o-mania.com (scareware)"; content:"|0c|sink-o-mania|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siycugufryyrkoylky.co.cc (scareware)"; content:"|12|siycugufryyrkoylky|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skintwo.biz (scareware)"; content:"|07|skintwo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sklep.af.com.pl (scareware)"; content:"|05|sklep|02|af|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sklep.autorud.pl (scareware)"; content:"|05|sklep|07|autorud|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sklep.kafti.com (scareware)"; content:"|05|sklep|05|kafti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sklep.mago.com.pl (scareware)"; content:"|05|sklep|04|mago|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sklep1.vinylove.pl (scareware)"; content:"|06|sklep1|08|vinylove|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skleplotniczy.pl (scareware)"; content:"|0d|skleplotniczy|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skriptorium.at (scareware)"; content:"|0b|skriptorium|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smallspacearts.com (scareware)"; content:"|0e|smallspacearts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartbestav10.co.cc (scareware)"; content:"|0d|smartbestav10|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smscom.nl (scareware)"; content:"|06|smscom|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snews.com.tw (scareware)"; content:"|05|snews|03|com|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soposhinvitations.com (scareware)"; content:"|11|soposhinvitations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sounluolvuoxyqixky.co.cc (scareware)"; content:"|12|sounluolvuoxyqixky|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacevisionarts.com (scareware)"; content:"|0f|spacevisionarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spine.com.br (scareware)"; content:"|05|spine|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportfishingarts.com (scareware)"; content:"|10|sportfishingarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sprqucoatz.co.cc (scareware)"; content:"|0a|sprqucoatz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sslillisilsltlis.com (zeus)"; content:"|10|sslillisilsltlis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup standrite.com (scareware)"; content:"|09|standrite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stvpar.info (zeus)"; content:"|06|stvpar|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup szemuvegkeret.com (scareware)"; content:"|0d|szemuvegkeret|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teldatawarehouse.com (scareware)"; content:"|10|teldatawarehouse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teoflowerbulbs.ro (scareware)"; content:"|0e|teoflowerbulbs|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tiouw.nl (scareware)"; content:"|05|tiouw|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup triominos.ru (scareware)"; content:"|09|triominos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ucywmuziboytylwi.co.cc (scareware)"; content:"|10|ucywmuziboytylwi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ullihome.de (scareware)"; content:"|08|ullihome|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unotufukujygugusto.co.cc (scareware)"; content:"|12|unotufukujygugusto|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uptowntrellis.co.nz (scareware)"; content:"|0d|uptowntrellis|02|co|02|nz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup upykhogupiybuwojyz.co.cc (scareware)"; content:"|12|upykhogupiybuwojyz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uralweb.ru (malware)"; content:"|07|uralweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usbokuycryocyjykqi.co.cc (scareware)"; content:"|12|usbokuycryocyjykqi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup viasapia.com.br (scareware)"; content:"|08|viasapia|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vita-bhv.nl (scareware)"; content:"|08|vita-bhv|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vobyumfoodzygubuyv.co.cc (scareware)"; content:"|12|vobyumfoodzygubuyv|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgetwise.com (harmful)"; content:"|0a|webgetwise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmas.ca (scareware)"; content:"|06|webmas|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wesellmac.com (scareware)"; content:"|09|wesellmac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup widlak-market.com (scareware)"; content:"|0d|widlak-market|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wireandthewood.com (scareware)"; content:"|0e|wireandthewood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wscll2.net (scareware)"; content:"|06|wscll2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wz978.net (harmful)"; content:"|05|wz978|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xfour.es (scareware)"; content:"|05|xfour|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xodovumuycguhyujip.co.cc (scareware)"; content:"|12|xodovumuycguhyujip|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yeti.com.pl (scareware)"; content:"|04|yeti|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yfwiiwoqwipihovo.co.cc (scareware)"; content:"|10|yfwiiwoqwipihovo|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ygitysbocysokuujok.co.cc (scareware)"; content:"|12|ygitysbocysokuujok|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ykraivec.co.cc (scareware)"; content:"|08|ykraivec|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ynywyvtioxiloghoin.co.cc (scareware)"; content:"|12|ynywyvtioxiloghoin|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourbestchose.co.cc (scareware)"; content:"|0d|yourbestchose|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yzirukwoilokocpohi.co.cc (scareware)"; content:"|12|yzirukwoilokocpohi|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeferesds.com (malware)"; content:"|09|zeferesds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bro.tw (malware)"; content:"|03|bro|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findbigmoneygame.cn (gumblar)"; content:"|10|findbigmoneygame|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatnamemovie.cn (gumblar)"; content:"|0e|greatnamemovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2677.in (malware)"; content:"|04|2677|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3x55conto.nu (zeus)"; content:"|09|3x55conto|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adspace.img.fux.com (malware)"; content:"|07|adspace|03|img|03|fux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adultxxxblog19.in (malware)"; content:"|0e|adultxxxblog19|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antony.freewebhostx.com (malware)"; content:"|06|antony|0c|freewebhostx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apocalypticdose.com (malware)"; content:"|0f|apocalypticdose|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arsenalik.ru (zeus)"; content:"|09|arsenalik|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arxa.110mb.com (malware)"; content:"|04|arxa|05|110mb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup automaticsecurityscan.com (malware)"; content:"|15|automaticsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baxm.ru (malware)"; content:"|04|baxm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beautifulsecurityscan.com (malware)"; content:"|15|beautifulsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestindiansexvideos.com (crimepack)"; content:"|13|bestindiansexvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestviewbars.com (zeus)"; content:"|0c|bestviewbars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigpayinfos.com (zeus)"; content:"|0b|bigpayinfos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biklmner.com (malware)"; content:"|08|biklmner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bioparking.info (zeus)"; content:"|0a|bioparking|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxnusst1e.com (trojan)"; content:"|0a|boxnusst1e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buy-is2010.com (rogue)"; content:"|0a|buy-is2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbsnet.co.za (malware)"; content:"|06|cbsnet|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cellphones.mooo.com (malware)"; content:"|0a|cellphones|04|mooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chance46pace.blog.com (malware)"; content:"|0c|chance46pace|04|blog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chance46pace.diaryland.com (malware)"; content:"|0c|chance46pace|09|diaryland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup computermumbai.com (malware)"; content:"|0e|computermumbai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybertranceru.ru (zeus)"; content:"|0d|cybertranceru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailynetblog.com (malware)"; content:"|0c|dailynetblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ddll.in (malware)"; content:"|04|ddll|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defendvirus.com (rogue)"; content:"|0b|defendvirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domains.txt (8080malware)"; content:"|07|domains|03|txt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadfreenow.in (malware)"; content:"|0f|downloadfreenow|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dragofss.com (malware)"; content:"|08|dragofss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsfkdj383dmdjk.com (trojan)"; content:"|0e|dsfkdj383dmdjk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dykkerklubben.net (malware)"; content:"|0d|dykkerklubben|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dynvolume.com (trojan)"; content:"|09|dynvolume|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup erbition.com (neosploit)"; content:"|08|erbition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewzine.com (malware)"; content:"|06|ewzine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyx8.com (malware)"; content:"|04|eyx8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup file.mm.co.kr (malware)"; content:"|04|file|02|mm|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup files-online.ru (zeus)"; content:"|0c|files-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderdea.org (malware)"; content:"|09|finderdea|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashplyaer.info (zeus)"; content:"|0b|flashplyaer|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeweightloss.lovefoodbefit.com (malware)"; content:"|0e|freeweightloss|0d|lovefoodbefit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshcontentengine.multiply.com (malware)"; content:"|12|freshcontentengine|08|multiply|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshcontentengine.vox.com (malware)"; content:"|12|freshcontentengine|03|vox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaxeexchange.com (malware)"; content:"|0c|gaxeexchange|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hartenbodo.fileave.com (malware)"; content:"|0a|hartenbodo|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hi5-imgs.net (malware)"; content:"|08|hi5-imgs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiphopniger.com (zeus)"; content:"|0b|hiphopniger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icia.t35.com (malware)"; content:"|04|icia|03|t35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilterrazzoallaveneziana.it (malware)"; content:"|17|ilterrazzoallaveneziana|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img-myspaces.com (malware)"; content:"|0c|img-myspaces|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inexpensive-furniture.com (malware)"; content:"|15|inexpensive-furniture|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itmakemehappy.com (malware)"; content:"|0d|itmakemehappy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joprestons.net (exploit)"; content:"|0a|joprestons|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaael.in (exploit)"; content:"|05|kaael|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaaleeks.net (exploit)"; content:"|08|kaaleeks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klonding.com (malware)"; content:"|08|klonding|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kucharze.info (malware)"; content:"|08|kucharze|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ldah.net (zeus)"; content:"|04|ldah|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup library.cshl.edu (malware)"; content:"|07|library|04|cshl|03|edu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifeps.net (malware)"; content:"|06|lifeps|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ligatu.fileave.com (malware)"; content:"|06|ligatu|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lillebaeltejendomme.dk (malware)"; content:"|13|lillebaeltejendomme|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limenspot.com (malware)"; content:"|09|limenspot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macromediatest.com (malware)"; content:"|0e|macromediatest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaaidsite.com (malware)"; content:"|0c|mediaaidsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediagroupquiz.com (malware)"; content:"|0e|mediagroupquiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metalinkltd.com (malware)"; content:"|0b|metalinkltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixtim23.dominiotemporario.com (malware)"; content:"|08|mixtim23|11|dominiotemporario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mjbims7m.ru (malware)"; content:"|08|mjbims7m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moscowismine.in (malware)"; content:"|0c|moscowismine|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mutinied.info (exploit)"; content:"|08|mutinied|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-spacess.com (malware)"; content:"|0a|my-spacess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myblogfriend.com (malware)"; content:"|0c|myblogfriend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymoviestyle.com (malware)"; content:"|0c|mymoviestyle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypersonalroomservice.ws (malware)"; content:"|15|mypersonalroomservice|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myspaaces.net (malware)"; content:"|09|myspaaces|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naq-herdam.com (exploit)"; content:"|0a|naq-herdam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networkget.com (malware)"; content:"|0a|networkget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsbosnia.org (malware)"; content:"|0a|newsbosnia|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt12.co.in (malware)"; content:"|04|nt12|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oblspecstroi.ru (malware)"; content:"|0c|oblspecstroi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okrison.com (zeus)"; content:"|07|okrison|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup opazbz.com (malware)"; content:"|06|opazbz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup origin-ics.hotbar.com (malware)"; content:"|0a|origin-ics|06|hotbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup otloade12.info (rogue)"; content:"|09|otloade12|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parasolka.in (malware)"; content:"|09|parasolka|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup parfaitpournous.com (zeus)"; content:"|0f|parfaitpournous|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phaizeipeu.ru (zeus)"; content:"|0a|phaizeipeu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porno-video-hunt.co.cc (malware)"; content:"|10|porno-video-hunt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntube-fast.com (rogue)"; content:"|0d|porntube-fast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntube-todayx.com (rogue)"; content:"|0f|porntube-todayx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup promojoy.net (zeus)"; content:"|08|promojoy|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protectyourpc-11.com (malware)"; content:"|10|protectyourpc-11|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup public.blu.livefilestore.com (malware)"; content:"|06|public|03|blu|0d|livefilestore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qikafojuc.cn (rogue)"; content:"|09|qikafojuc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realstatecuador.com (malware)"; content:"|0f|realstatecuador|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reger0582.com (exploit)"; content:"|09|reger0582|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reklamen7.ru (malware)"; content:"|09|reklamen7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rrri.uicp.cn (malware)"; content:"|04|rrri|04|uicp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rscenter.website.pl (zeus)"; content:"|08|rscenter|07|website|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sapolandialanche.hpg.com.br (malware)"; content:"|10|sapolandialanche|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-interface.com (rogue)"; content:"|11|scanner-interface|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-tips.com (rogue)"; content:"|0c|scanner-tips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexadults.ru (8080malware)"; content:"|09|sexadults|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexhotmamba.ru (8080malware)"; content:"|0b|sexhotmamba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexmambass.ru (8080malware)"; content:"|0a|sexmambass|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexmambu.ru (8080malware)"; content:"|08|sexmambu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexplaycom.ru (8080malware)"; content:"|0a|sexplaycom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shup.com (trojan)"; content:"|04|shup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slutload.org.uk (crimepack)"; content:"|08|slutload|03|org|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soldierantivirus.com (malware)"; content:"|10|soldierantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sony-universo3d.com (malware)"; content:"|0f|sony-universo3d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sporthal.msolutions.be (malware)"; content:"|08|sporthal|0a|msolutions|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportvision.cl (malware)"; content:"|0b|sportvision|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sportxxx-ltd.com (malware)"; content:"|0c|sportxxx-ltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sputv.ru (malware)"; content:"|05|sputv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syszone.co.kr (malware)"; content:"|07|syszone|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technology-scanner.com (malware)"; content:"|12|technology-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup telecharger-poker-star.fr (malware)"; content:"|16|telecharger-poker-star|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theautocompanyy.info (malware)"; content:"|0f|theautocompanyy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelbaldoart.hpg.com.br (malware)"; content:"|0c|thelbaldoart|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tizimoyiy.cn (rogue)"; content:"|09|tizimoyiy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trepluyt.com (malware)"; content:"|08|trepluyt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttyur.com (malware)"; content:"|05|ttyur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tunisia-security.com (zeus)"; content:"|10|tunisia-security|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tutani.co.cc (exploit)"; content:"|06|tutani|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ultra-light4u.net (zeus)"; content:"|0d|ultra-light4u|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update2date.com (zeus)"; content:"|0b|update2date|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utrvc.com (malware)"; content:"|05|utrvc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vegascity24.com (malware)"; content:"|0b|vegascity24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veropoema.net (malware)"; content:"|09|veropoema|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkoim.ru (malware)"; content:"|05|vkoim|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup watchindiansexvideos.com (crimepack)"; content:"|14|watchindiansexvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webonline.is-a-geek.net (malware)"; content:"|09|webonline|09|is-a-geek|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wfrtube.net (zeus)"; content:"|07|wfrtube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whyustrust.com (malware)"; content:"|0a|whyustrust|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup workslikethat.com (exploit)"; content:"|0d|workslikethat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xunttsyiinb.com (malware)"; content:"|0b|xunttsyiinb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xxxbeastmovs.in (malware)"; content:"|0c|xxxbeastmovs|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yeshouse.net (malware)"; content:"|08|yeshouse|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ytoimneyqawernmkla.deswelt.net (malware)"; content:"|12|ytoimneyqawernmkla|07|deswelt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zanga.haos.ro (zeus)"; content:"|05|zanga|04|haos|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zeppbrannigan.com (zeus)"; content:"|0d|zeppbrannigan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zzgame.co.kr (malware)"; content:"|06|zzgame|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 221212121.ru (malware)"; content:"|09|221212121|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3vu76g4ef.co.cc (malware)"; content:"|09|3vu76g4ef|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arsdh.in (exploit)"; content:"|05|arsdh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup besttap.ru (fastflux)"; content:"|07|besttap|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bun2.info (zeus)"; content:"|04|bun2|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campinglavall.net (zeus)"; content:"|0d|campinglavall|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caseva.es (zeus)"; content:"|06|caseva|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cdsgnk.com (malicious)"; content:"|06|cdsgnk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearstudiomedia.com (trojan)"; content:"|10|clearstudiomedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cooperaccio.org (zeus)"; content:"|0b|cooperaccio|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coremedianews.com (malware)"; content:"|0d|coremedianews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crexes.ru (malware)"; content:"|06|crexes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutchair.ru (fastflux)"; content:"|08|cutchair|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbcorps.com (malware)"; content:"|07|dbcorps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dewaned.eu (zeus)"; content:"|07|dewaned|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhhound.com (malware)"; content:"|07|dhhound|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evqwt.ru (zeus)"; content:"|05|evqwt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gocloth.ru (fastflux)"; content:"|07|gocloth|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herkalek.net (zeus)"; content:"|08|herkalek|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hi5views.com (malware)"; content:"|08|hi5views|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostshack.net (malware)"; content:"|09|hostshack|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hugefrogs.ru (fastflux)"; content:"|09|hugefrogs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iesahnaepi.ru (fastflux)"; content:"|0a|iesahnaepi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inhaber-moack.com (malware)"; content:"|0d|inhaber-moack|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ivanyi.homeip.net (malware)"; content:"|06|ivanyi|06|homeip|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jcfkprwasnaj.com (malware)"; content:"|0c|jcfkprwasnaj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johgheejae.ru (zeus)"; content:"|0a|johgheejae|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keridiangelis.com (exploit)"; content:"|0d|keridiangelis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup klajj.ru (zeus)"; content:"|05|klajj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lekbin.com (c&c)"; content:"|06|lekbin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup llessui.com (zeus)"; content:"|07|llessui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loteriahadamadrina.com (zeus)"; content:"|12|loteriahadamadrina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msdll.ru (fastflux)"; content:"|05|msdll|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup municipalidadlagoranco.cl (zeus)"; content:"|16|municipalidadlagoranco|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pausestorm.com (exploit)"; content:"|0a|pausestorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polotomo.com (zeus)"; content:"|08|polotomo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rekoplis.com (rogue)"; content:"|08|rekoplis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reservedomainforzs2.com (zeus)"; content:"|13|reservedomainforzs2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-master.com (rogue)"; content:"|0e|scanner-master|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-programming.com (malware)"; content:"|13|scanner-programming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup security-adress.com (malware)"; content:"|0f|security-adress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serraniasuroeste.org (zeus)"; content:"|10|serraniasuroeste|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sh000.com (malicious)"; content:"|05|sh000|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shortemail.ru (fastflux)"; content:"|0a|shortemail|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smokyegg.ru (fastflux)"; content:"|08|smokyegg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spyeye100.org (c&c)"; content:"|09|spyeye100|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statsianighteworkes.com (malware)"; content:"|13|statsianighteworkes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trust-update.com (zeus)"; content:"|0c|trust-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update4ever.ru (zeus)"; content:"|0b|update4ever|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateservice-server.net (malware)"; content:"|14|updateservice-server|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video4gamle.org (backdoor)"; content:"|0b|video4gamle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vopret.ru (malware)"; content:"|06|vopret|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrituyes.in (backdoor)"; content:"|08|vrituyes|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv05.info (malware)"; content:"|04|vv05|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whole-family-incest.com (fastflux)"; content:"|13|whole-family-incest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woodruby.net (zeus)"; content:"|08|woodruby|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xdebuuwxoxk.com (malware)"; content:"|0b|xdebuuwxoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yeeshiedot.ru (zeus)"; content:"|0a|yeeshiedot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zebrabel1.co.cc (exploit)"; content:"|09|zebrabel1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ziosuovareipheighaisheek.com (zeus)"; content:"|18|ziosuovareipheighaisheek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopfindsite.cn (malware)"; content:"|0e|bigtopfindsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thelotmachine.cn (malware)"; content:"|0d|thelotmachine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenetnameshop.cn (malware)"; content:"|0e|thenetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetrafficcontrol.net (malware)"; content:"|11|thetrafficcontrol|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourlitetop.cn (gumblar)"; content:"|0b|yourlitetop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7gafd33ja90a.com (malware)"; content:"|0c|7gafd33ja90a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abtdiagnostic.com (malware)"; content:"|0d|abtdiagnostic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acdftbbaoxk.com (malware)"; content:"|0b|acdftbbaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup admin-x.de (malware)"; content:"|07|admin-x|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads-search.com (trojan)"; content:"|0a|ads-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aebankonline.com (malware)"; content:"|0c|aebankonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alcamarsaci.cl (zeus)"; content:"|0b|alcamarsaci|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup algis-khv.ru (malware)"; content:"|09|algis-khv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amadox.nl (malware)"; content:"|06|amadox|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amerp.in (malware)"; content:"|05|amerp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anathema.yurx.com (malware)"; content:"|08|anathema|04|yurx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arnold.kz (malware)"; content:"|06|arnold|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arthur-demo.fr (malware)"; content:"|0b|arthur-demo|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arthurp.fr (malware)"; content:"|07|arthurp|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aschw.in (malware)"; content:"|05|aschw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barcalys-trial3.com (malware)"; content:"|0f|barcalys-trial3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barriolamc.com (zeus)"; content:"|0a|barriolamc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bedayton.com (malware)"; content:"|08|bedayton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-online1.com (malware)"; content:"|0c|best-online1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-real-tube.com (malware)"; content:"|0e|best-real-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigboatmedia.com (malware)"; content:"|0c|bigboatmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigsecurityscan.com (malware)"; content:"|0f|bigsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blacksecurityscan.com (malware)"; content:"|11|blacksecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bossmediaservices.com (malware)"; content:"|11|bossmediaservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup braiener.com (malware)"; content:"|08|braiener|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbphase.com (malware)"; content:"|07|cbphase|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cerclewalloncouillet.be (malware)"; content:"|14|cerclewalloncouillet|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chileenduro.cl (malware)"; content:"|0b|chileenduro|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chipsoftindia.com (malware)"; content:"|0d|chipsoftindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clearpathhealingarts.com (malware)"; content:"|14|clearpathhealingarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clkh71yhks66.com (malware)"; content:"|0c|clkh71yhks66|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conrp.in (malware)"; content:"|05|conrp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup creation-site.arthur-com.net (malware)"; content:"|0d|creation-site|0a|arthur-com|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup developpeur-drupal.com (malware)"; content:"|12|developpeur-drupal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diggingforroots.com (malware)"; content:"|0f|diggingforroots|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitallightdata.com (malware)"; content:"|10|digitallightdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup direktlinks.info (malware)"; content:"|0b|direktlinks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain460003.com (zeus)"; content:"|0c|domain460003|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domusconsul.hu (malware)"; content:"|0b|domusconsul|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloads.picterezmap-008.com (malware)"; content:"|09|downloads|0f|picterezmap-008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsfspaoi.info (malware)"; content:"|08|dsfspaoi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e-depot.co.jp (malware)"; content:"|07|e-depot|02|co|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eagen85.net (malware)"; content:"|07|eagen85|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edscorpor.com (malware)"; content:"|09|edscorpor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsctrum.com (malware)"; content:"|08|edsctrum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsfiles.com (malware)"; content:"|08|edsfiles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsfilles.com (malware)"; content:"|09|edsfilles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsletter.com (malware)"; content:"|09|edsletter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edslgored.com (malware)"; content:"|09|edslgored|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsnewter.com (malware)"; content:"|09|edsnewter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsogos.com (malware)"; content:"|07|edsogos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsspectr.com (malware)"; content:"|09|edsspectr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edstoox.com (malware)"; content:"|07|edstoox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eethahchaehiexahgeemaugh.com (malware)"; content:"|18|eethahchaehiexahgeemaugh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emapis.org (hack)"; content:"|06|emapis|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup err3uperr.co.cc (malware)"; content:"|09|err3uperr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurostargroup.ws (iframe)"; content:"|0d|eurostargroup|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ever52592g.com (malware)"; content:"|0a|ever52592g|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup f-myspace.net (malware)"; content:"|09|f-myspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fb-viewing.net (malware)"; content:"|0a|fb-viewing|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fenhw.in (malware)"; content:"|05|fenhw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finderwid.org (malware)"; content:"|09|finderwid|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findsecurityscan.com (malware)"; content:"|10|findsecurityscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash-exe-video.co.tv (malware)"; content:"|0f|flash-exe-video|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gerointyt.net (malware)"; content:"|09|gerointyt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gighw.in (exploit)"; content:"|05|gighw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigoweb.mine.nu (malware)"; content:"|07|gigoweb|04|mine|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gite-eguisheim.com (malware)"; content:"|0e|gite-eguisheim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server09.info (malware)"; content:"|0f|google-server09|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server10.info (malware)"; content:"|0f|google-server10|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server11.info (malware)"; content:"|0f|google-server11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server12.info (malware)"; content:"|0f|google-server12|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server14.info (malware)"; content:"|0f|google-server14|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server29.info (malware)"; content:"|0f|google-server29|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-server31.info (malware)"; content:"|0f|google-server31|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleapis.biz (hack)"; content:"|0a|googleapis|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hapug.in (malware)"; content:"|05|hapug|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hgptd.com (malware)"; content:"|05|hgptd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyporesist.com (malware)"; content:"|0a|hyporesist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup institut-developpement-durable.com (malware)"; content:"|1e|institut-developpement-durable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup internetgotours.com (malware)"; content:"|0f|internetgotours|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jdfgut.com (malware)"; content:"|06|jdfgut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhuiuhxfgxhlfkjhjth.info (malware)"; content:"|13|jhuiuhxfgxhlfkjhjth|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhuiuhxfgxhtfkjhjth.info (malware)"; content:"|13|jhuiuhxfgxhtfkjhjth|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jhuluhxfgxhlfkjhjth.info (malware)"; content:"|13|jhuluhxfgxhlfkjhjth|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup korvet.in (malware)"; content:"|06|korvet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ku.perfectexe.com (malware)"; content:"|02|ku|0a|perfectexe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup la2planet.1gb.ru (malware)"; content:"|09|la2planet|03|1gb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ldeqkkmloxk.com (malware)"; content:"|0b|ldeqkkmloxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup macacodoido.pagebr.com (malware)"; content:"|0b|macacodoido|06|pagebr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaboomgo.com (malware)"; content:"|0b|mediaboomgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediagotech.com (malware)"; content:"|0b|mediagotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaonesoftware.com (malware)"; content:"|10|mediaonesoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaracinggo.com (malware)"; content:"|0d|mediaracinggo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediarymedia.com (malware)"; content:"|0c|mediarymedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediasupermart.com (malware)"; content:"|0e|mediasupermart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup memory-scanner.com (malware)"; content:"|0e|memory-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mghtdapmoxk.com (malware)"; content:"|0b|mghtdapmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylexa.com (malware)"; content:"|06|mylexa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netgozero.com (malware)"; content:"|09|netgozero|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup networksportsgo.com (malware)"; content:"|0f|networksportsgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newsapis.us (hack)"; content:"|08|newsapis|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ns28780.ovh.net (malware)"; content:"|07|ns28780|03|ovh|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obsidallynd.com (malware)"; content:"|0b|obsidallynd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onefindup.org (malware)"; content:"|09|onefindup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online-photo-albums.org (malware)"; content:"|13|online-photo-albums|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porto.napoli.it (malware)"; content:"|05|porto|06|napoli|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qghtdopqoxk.com (malware)"; content:"|0b|qghtdopqoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup r-myspace.net (mattlware)"; content:"|09|r-myspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-album.com (malware)"; content:"|0d|scanner-album|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-definition.com (malware)"; content:"|12|scanner-definition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-hardware.com (malware)"; content:"|10|scanner-hardware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-profile.com (malware)"; content:"|0f|scanner-profile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-supplies.com (malware)"; content:"|10|scanner-supplies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdubles.org (malware)"; content:"|0c|searchdubles|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchmartiup.org (malware)"; content:"|0d|searchmartiup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchprasup.org (malware)"; content:"|0c|searchprasup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchprodinc.org (malware)"; content:"|0d|searchprodinc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchtanup.org (malware)"; content:"|0b|searchtanup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartcontrol.info (trojan)"; content:"|0c|smartcontrol|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartenergymodel.com (hack)"; content:"|10|smartenergymodel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spmfb2299.com (malware)"; content:"|09|spmfb2299|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spmfb3309.com (malware)"; content:"|09|spmfb3309|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats.arthur-com.net (malware)"; content:"|05|stats|0a|arthur-com|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup styletown.ru (malware)"; content:"|09|styletown|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superfilestools.com (malware)"; content:"|0f|superfilestools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superhomelawn.com (malware)"; content:"|0d|superhomelawn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superwebmedia.com (malware)"; content:"|0d|superwebmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themultimediastream.com (malware)"; content:"|13|themultimediastream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toolbarinc.com (hack)"; content:"|0a|toolbarinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top-teen-porn.info (malware)"; content:"|0d|top-teen-porn|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tributem.com (zeus)"; content:"|08|tributem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tupin.in (malware)"; content:"|05|tupin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vostokgear.org (malware)"; content:"|0a|vostokgear|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webcoolgo.com (malware)"; content:"|09|webcoolgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgoengine.com (malware)"; content:"|0b|webgoengine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webgosolutions.com (malware)"; content:"|0e|webgosolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmagicgo.com (malware)"; content:"|0a|webmagicgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websitecoolgo.com (malware)"; content:"|0d|websitecoolgo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup websiteget.com (malware)"; content:"|0a|websiteget|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westmediasystem.com (malware)"; content:"|0f|westmediasystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wifahquaht.ru (malware)"; content:"|0a|wifahquaht|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wrtybvim.com (malware)"; content:"|08|wrtybvim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z-myspace.net (malware)"; content:"|09|z-myspace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z0g7ya1i0.com (malware)"; content:"|09|z0g7ya1i0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gcounter.cn (harmful)"; content:"|08|gcounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalmixgroup.cn (malware)"; content:"|0e|globalmixgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalnameshop.cn (malware)"; content:"|0e|globalnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netflyer.net (malware)"; content:"|08|netflyer|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5188wow.com (trojan)"; content:"|07|5188wow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5q4eyd2w.ru (malware)"; content:"|08|5q4eyd2w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3crg.co.uk (malware)"; content:"|05|a3crg|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abbonamenti.e-duesse.it (malware)"; content:"|0b|abbonamenti|08|e-duesse|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acc0n3.scrapping.cc (botnet)"; content:"|06|acc0n3|09|scrapping|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acrobat-reader-download.com (phishing)"; content:"|17|acrobat-reader-download|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afretroactive.com (trojan)"; content:"|0d|afretroactive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aidanimaldental.com (malware)"; content:"|0f|aidanimaldental|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup andressolimano.com (exploit)"; content:"|0e|andressolimano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anirp.in (exploit)"; content:"|05|anirp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antinseto.com.br (malware)"; content:"|09|antinseto|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arlingtoneagles.net (malware)"; content:"|0f|arlingtoneagles|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babondolk.com (zeus)"; content:"|09|babondolk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup babyland.lt (malware)"; content:"|08|babyland|02|lt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidudfr.com (malware)"; content:"|08|baidudfr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billlez.cn (malware)"; content:"|07|billlez|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boonz.in (zeus)"; content:"|05|boonz|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup braveguard2.co.cc (rogue)"; content:"|0b|braveguard2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsbclube.com.br (backdoor)"; content:"|08|bsbclube|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cadaris.com.br (exploit)"; content:"|07|cadaris|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceguku.in (trojan)"; content:"|06|ceguku|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ces-hunter.com (exploitkit)"; content:"|0a|ces-hunter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceters.net (trojan)"; content:"|06|ceters|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chapisteriadaniel.com (malware)"; content:"|11|chapisteriadaniel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codecmicrosoft.com (trojan)"; content:"|0e|codecmicrosoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cowzq.in (malware)"; content:"|05|cowzq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup declaracion.bde.es.psdrv.ru (zeus)"; content:"|0b|declaracion|03|bde|02|es|05|psdrv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dive2world.com (rfi)"; content:"|0a|dive2world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkanager.com (malware)"; content:"|08|dkanager|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.keymatch.kr (malware)"; content:"|04|down|08|keymatch|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dxwld.in (trojan)"; content:"|05|dxwld|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elensoft.narod.ru (malware)"; content:"|08|elensoft|05|narod|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esportsboard.com (malware)"; content:"|0c|esportsboard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fast-scanneronline.org (malware)"; content:"|12|fast-scanneronline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastcleancure47pd.co.cc (rogue)"; content:"|11|fastcleancure47pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flyingwings.ch (malware)"; content:"|0b|flyingwings|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewarezsoft.com (fakevideo)"; content:"|0d|freewarezsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup full-free-rapidshare.com (fakevideo)"; content:"|14|full-free-rapidshare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gaople.info (neosploit)"; content:"|06|gaople|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup garantipornoizle.com (exploit)"; content:"|10|garantipornoizle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gayq8rgx.ru (malware)"; content:"|08|gayq8rgx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalwarmingtray.info (rogue)"; content:"|11|globalwarmingtray|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup go-teen.com (exploit)"; content:"|07|go-teen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goddamn.in (zeus)"; content:"|07|goddamn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gosin.be (malware)"; content:"|05|gosin|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hejihi.in (trojan)"; content:"|06|hejihi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hemex.in (malware)"; content:"|05|hemex|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hevoltados.com.br (malware)"; content:"|0a|hevoltados|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitmain.t35.com (exploit)"; content:"|07|hitmain|03|t35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup home-hifi.be (malware)"; content:"|09|home-hifi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hothack.es.tl (malware)"; content:"|07|hothack|02|es|02|tl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huffdt.com (malware)"; content:"|06|huffdt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i0jxx.com (malware)"; content:"|05|i0jxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iamcome.in (malware)"; content:"|07|iamcome|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iconator.com (exploit)"; content:"|08|iconator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup industrialwholesale.com (malware)"; content:"|13|industrialwholesale|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ircd-net.macsn.de (trojan)"; content:"|08|ircd-net|05|macsn|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup irisjard.o2switch.net (malware)"; content:"|08|irisjard|08|o2switch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itotolo.com (malware)"; content:"|07|itotolo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krakinderviksa.com (zeus)"; content:"|0e|krakinderviksa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kulinarz.ru (trojan)"; content:"|08|kulinarz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup legalhelpmultimedia.com (trojan)"; content:"|13|legalhelpmultimedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manalive2010.org (malware)"; content:"|0c|manalive2010|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup manupprincess.com (malware)"; content:"|0d|manupprincess|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marco-mty.com.mx (malware)"; content:"|09|marco-mty|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcafee-registry.ru (zeus)"; content:"|0f|mcafee-registry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mclaugn.ru (malware)"; content:"|07|mclaugn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mibeli.in (trojan)"; content:"|06|mibeli|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup militaryseeds.org (zeus)"; content:"|0d|militaryseeds|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnfrekjivr.com (exploit)"; content:"|0a|mnfrekjivr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mps-sbn.com (rfi)"; content:"|07|mps-sbn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup multprintx.dominiotemporario.com (trojan)"; content:"|0a|multprintx|11|dominiotemporario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycenterdh.info (trojan)"; content:"|0a|mycenterdh|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mycenterry.info (trojan)"; content:"|0a|mycenterry|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myownprotecton.com (rogue)"; content:"|0e|myownprotecton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mysafeprotecton.com (rogue)"; content:"|0f|mysafeprotecton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myususalprotecton.com (rogue)"; content:"|11|myususalprotecton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nevereversite.ru (zeus)"; content:"|0d|nevereversite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nossanovatentativa.hpg.com.br (malware)"; content:"|12|nossanovatentativa|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nowmessengerservice.net (exploit)"; content:"|13|nowmessengerservice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nt13.co.in (pdfexploit)"; content:"|04|nt13|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ntec2010.com (trojan)"; content:"|08|ntec2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ol34peifjd.in (malware)"; content:"|0a|ol34peifjd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onmyprotection.com (rogue)"; content:"|0e|onmyprotection|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pcsweeper.co.kr (malware)"; content:"|09|pcsweeper|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup please-unblock-me.com (phishing)"; content:"|11|please-unblock-me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polkiman.com (malware)"; content:"|08|polkiman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornocomprazer.com (malware)"; content:"|0e|pornocomprazer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup privacyzero.com (malware)"; content:"|0b|privacyzero|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pro.dbclean.co.kr (malware)"; content:"|03|pro|07|dbclean|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup public.bay.livefilestore.com (trojan)"; content:"|06|public|03|bay|0d|livefilestore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rc.r-c.co.kr (trojan)"; content:"|02|rc|03|r-c|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realfun.ro (malware)"; content:"|07|realfun|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realitynow1.co.cc (attackpage)"; content:"|0b|realitynow1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rebonklo.com (malware)"; content:"|08|rebonklo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup red3389.com (trojan)"; content:"|07|red3389|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scarpina.ch (malware)"; content:"|08|scarpina|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scgdemo.com (malware)"; content:"|07|scgdemo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sedw.interfree.it (malware)"; content:"|04|sedw|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seeblick-sylt.de (rfi)"; content:"|0d|seeblick-sylt|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sms-referati.ru (malware)"; content:"|0c|sms-referati|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soluciongana.com (malware)"; content:"|0c|soluciongana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sondaggioelezioni.com (exploit)"; content:"|11|sondaggioelezioni|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spinpoll.com (rogue)"; content:"|08|spinpoll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streetgetthen.net (rogue)"; content:"|0d|streetgetthen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syservent.com (malware)"; content:"|09|syservent|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetestmedia.com (malware)"; content:"|0c|thetestmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup toutube.cn (zeus)"; content:"|07|toutube|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-crash.com (trojan)"; content:"|0d|traffic-crash|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup translate-google-cache.com (backdoor)"; content:"|16|translate-google-cache|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuparadas.com (exploit)"; content:"|09|tuparadas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unitedlegalmedia.com (trojan)"; content:"|10|unitedlegalmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usualprotecton.com (rogue)"; content:"|0e|usualprotecton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valdez.at.ua (malware)"; content:"|06|valdez|02|at|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vandgold11.hpg.com.br (malware)"; content:"|0a|vandgold11|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vandgold22.hpg.com.br (malware)"; content:"|0a|vandgold22|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vc8t.com (trojan)"; content:"|04|vc8t|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup victorgrijo.hpg.com.br (malware)"; content:"|0b|victorgrijo|03|hpg|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv00vv.biz (zeus)"; content:"|06|vv00vv|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv01.info (malware)"; content:"|04|vv01|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvie.net (trojan)"; content:"|04|vvie|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web.dakoa.cn (trojan)"; content:"|03|web|05|dakoa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup weightlosssolutionsblog.com (malware)"; content:"|17|weightlosssolutionsblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winsecureservice.com (backdoor)"; content:"|10|winsecureservice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woningprikbord.nl (malware)"; content:"|0e|woningprikbord|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yearprotecton.com (rogue)"; content:"|0d|yearprotecton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yollomeo.com (malware)"; content:"|08|yollomeo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtubemobiile.com (trojan)"; content:"|0e|youtubemobiile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yx.baidu.com (malware)"; content:"|02|yx|05|baidu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yyer.ru (zeus)"; content:"|04|yyer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zroot.info.tm (zeus)"; content:"|05|zroot|04|info|02|tm"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuklonma.com (rogue)"; content:"|08|zuklonma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 07168.net (harmful)"; content:"|05|07168|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2012babah2012.com (zeus)"; content:"|0d|2012babah2012|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30th-birthday.com (harmful)"; content:"|0d|30th-birthday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3pulenepro.net (zeus)"; content:"|0a|3pulenepro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobesoftech.co.tv (malicious)"; content:"|0c|adobesoftech|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ads.co.in (harmful)"; content:"|03|ads|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwa23.com (malware)"; content:"|06|adwa23|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alsons.ru (zeus)"; content:"|06|alsons|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup am-remorquage.fr (malicious)"; content:"|0d|am-remorquage|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annintus.com (zeus)"; content:"|08|annintus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arpeggi0s.com (trojan)"; content:"|09|arpeggi0s|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atechnologyscanner.com (rogue)"; content:"|12|atechnologyscanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balem.net (malicious)"; content:"|05|balem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcbcnc.com (threat)"; content:"|06|bcbcnc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bgknoccout.com (harmful)"; content:"|0a|bgknoccout|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bits4ever.ru (zeus)"; content:"|09|bits4ever|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blogjo.biz (malicious)"; content:"|06|blogjo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bogobogo.net (harmful)"; content:"|08|bogobogo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breakingnewsofmom.com (fastflux)"; content:"|11|breakingnewsofmom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup breefingteam.com (exploit)"; content:"|0c|breefingteam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup caer-doofer.com (trojan)"; content:"|0b|caer-doofer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashmaker-mom.com (fastflux)"; content:"|0d|cashmaker-mom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cashmakermomsecrets.com (fastflux)"; content:"|13|cashmakermomsecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceterz.com (trojan)"; content:"|06|ceterz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chicken09.thruhere.net (trojan)"; content:"|09|chicken09|08|thruhere|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chto.su (malicious)"; content:"|04|chto|02|su"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crewbiz.net (exploit)"; content:"|07|crewbiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfgswfodoxk.com (exploit)"; content:"|0b|dfgswfodoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diarqdndoxk.com (exploit)"; content:"|0b|diarqdndoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dijitalkalip.com (harmful)"; content:"|0c|dijitalkalip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctornimnul.com (zeus)"; content:"|0c|doctornimnul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domain460008.com (malicious)"; content:"|0c|domain460008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup down.unovt.com (trojan)"; content:"|04|down|05|unovt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emailtheplanet.com (exploit)"; content:"|0e|emailtheplanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup equiny.com (malicious)"; content:"|06|equiny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eu-analytics.com (malicious)"; content:"|0c|eu-analytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ewet.org (harmful)"; content:"|04|ewet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup explorer-download.net (zeus)"; content:"|11|explorer-download|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileland.co.kr (exploit)"; content:"|08|fileland|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup finson.com (exploit)"; content:"|06|finson|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fleur-de-sante.ru (threat)"; content:"|0e|fleur-de-sante|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galaay.com (harmful)"; content:"|06|galaay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getnewfreeporn.in (malicious)"; content:"|0e|getnewfreeporn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googie-update.com (zeus)"; content:"|0d|googie-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grandeducation.ru (malicious)"; content:"|0e|grandeducation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grigga-sinna.com (malicious)"; content:"|0c|grigga-sinna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hermes1.nl (malicious)"; content:"|07|hermes1|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hikmesanbukais.com (trojan)"; content:"|0e|hikmesanbukais|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homes-belair.com (malicious)"; content:"|0c|homes-belair|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosanmt.net (malicious)"; content:"|07|hosanmt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsaaba.com (zeus)"; content:"|06|hsaaba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huashna.com (zeus)"; content:"|07|huashna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagehacks.info (harmful)"; content:"|0a|imagehacks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inmobiliariapymsa.com (malicious)"; content:"|11|inmobiliariapymsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joylol.awardspace.info (malicious)"; content:"|06|joylol|0a|awardspace|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kalekehert.net (malicious)"; content:"|0a|kalekehert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kdsa.or.kr (malicious)"; content:"|04|kdsa|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kindservicezeb.net (zeus)"; content:"|0e|kindservicezeb|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kqmxd.cn (trojan)"; content:"|05|kqmxd|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lib.willyselectronics.com (trojan)"; content:"|03|lib|11|willyselectronics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ligawebradio.com (malicious)"; content:"|0c|ligawebradio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lineage.cn.km.ua (exploit)"; content:"|07|lineage|02|cn|02|km|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makemoneyathome-site.com (fastflux)"; content:"|14|makemoneyathome-site|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makesfasesite.com (fastflux)"; content:"|0d|makesfasesite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malbobro.org (malicious)"; content:"|08|malbobro|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup martinandwood.com (threat)"; content:"|0d|martinandwood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mastersurpreenda0.t35.com (exploit)"; content:"|11|mastersurpreenda0|03|t35|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medianservicebz.net (malicious)"; content:"|0f|medianservicebz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediasuperbe.com (malicious)"; content:"|0c|mediasuperbe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megaantispy80.com (harmful)"; content:"|0d|megaantispy80|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-update.name (zeus)"; content:"|10|microsoft-update|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microtrendsa.co.cc (malicious)"; content:"|0c|microtrendsa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miror-counters.org (pdfexploit)"; content:"|0e|miror-counters|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mog4jr.net (zeus)"; content:"|06|mog4jr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momismakingcashathome.com (fastflux)"; content:"|15|momismakingcashathome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviecoupons.com (harmful)"; content:"|0c|moviecoupons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup msn-fblogs.com (malicious)"; content:"|0a|msn-fblogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup necice.in (malicious)"; content:"|06|necice|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nelmafirstusa.com (zeus)"; content:"|0d|nelmafirstusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup netsharingsite.com (trojan)"; content:"|0e|netsharingsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newdaypeace.org (malicious)"; content:"|0b|newdaypeace|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ootaivilei.ru (zeus)"; content:"|0a|ootaivilei|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pamparampa.net (malicious)"; content:"|0a|pamparampa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup panmiamibeach.com (zeus)"; content:"|0d|panmiamibeach|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phimhanquoc.info (malicious)"; content:"|0b|phimhanquoc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popcorn.ma (malicious)"; content:"|07|popcorn|02|ma"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup portland-traffic.com (malware)"; content:"|10|portland-traffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup psdrv.ru (fastflux)"; content:"|05|psdrv|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qsponik.com (malicious)"; content:"|07|qsponik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rctds.net (harmful)"; content:"|05|rctds|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup romeunplugged.com (harmful)"; content:"|0d|romeunplugged|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s-yahoo.info (zeus)"; content:"|07|s-yahoo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saveoursoul.es (malicious)"; content:"|0b|saveoursoul|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanbase4.com (malware)"; content:"|09|scanbase4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchrinup.org (malware)"; content:"|0b|searchrinup|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-stats.org (malicious)"; content:"|0c|secure-stats|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup senders2010.com (malicious)"; content:"|0b|senders2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-gifts.ru (malicious)"; content:"|09|sex-gifts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shgics.com (harmful)"; content:"|06|shgics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sicha-linna8.com (trojan)"; content:"|0c|sicha-linna8|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidematch.linkprice.com (exploit)"; content:"|09|sidematch|09|linkprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solaruploaderz.com (malicious)"; content:"|0e|solaruploaderz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solidarregion.at (malicious)"; content:"|0d|solidarregion|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonyproduction.in (zeus)"; content:"|0e|sonyproduction|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sorqusuzrapci.com (harmful)"; content:"|0d|sorqusuzrapci|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sosyalguvenlikmerkezi.org (harmful)"; content:"|15|sosyalguvenlikmerkezi|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup space-fblogs.com (malicious)"; content:"|0c|space-fblogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spacecake.se (harmful)"; content:"|09|spacecake|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup speedpos.com (exploit)"; content:"|08|speedpos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startprotectyoutoday.com (malicious)"; content:"|14|startprotectyoutoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teafun.sk (harmful)"; content:"|06|teafun|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thegalleriesxxx.com (harmful)"; content:"|0f|thegalleriesxxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traskl.ru (zeus)"; content:"|06|traskl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tyhomkol.com (malware)"; content:"|08|tyhomkol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uoptyr.com (malicious)"; content:"|06|uoptyr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-kabul.com (zeus)"; content:"|0c|update-kabul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vmcogulf.com (harmful)"; content:"|08|vmcogulf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup voidrage.com (malicious)"; content:"|08|voidrage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volgo-marun.cn (trojan)"; content:"|0b|volgo-marun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vsmd.kz (harmful)"; content:"|04|vsmd|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wandianji.com (exploit)"; content:"|09|wandianji|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wanko-manma.com (malicious)"; content:"|0b|wanko-manma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webmizersystems.com (malicious)"; content:"|0f|webmizersystems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup world.com (exploit)"; content:"|05|world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wtcfirstmovie.com (malicious)"; content:"|0d|wtcfirstmovie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xe54.com (pdfexploit)"; content:"|04|xe54|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xvaluegate.com (zeus)"; content:"|0a|xvaluegate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z0mb13.do.am (malicious)"; content:"|06|z0mb13|02|do|02|am"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0715tc.com (malware)"; content:"|06|0715tc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1pornomov.ru (malware)"; content:"|09|1pornomov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2012worldends.org (neosploit)"; content:"|0d|2012worldends|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 5ivealive.com (malware)"; content:"|09|5ivealive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aahydrogen.com (malware)"; content:"|0a|aahydrogen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adobeflash-f.co.cc (malware)"; content:"|0c|adobeflash-f|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aghtdqpaoxk.com (neosploit)"; content:"|0b|aghtdqpaoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alisehlikoyu.com (exploit)"; content:"|0c|alisehlikoyu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analizes.ru (malware)"; content:"|08|analizes|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalware-2010.net (malware)"; content:"|10|antimalware-2010|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antimalwarestore.com (harmful)"; content:"|10|antimalwarestore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apocalypt2.net (c&c)"; content:"|0a|apocalypt2|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b0tnet.tk (malware)"; content:"|06|b0tnet|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bulkbagsource.com (malware)"; content:"|0d|bulkbagsource|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cccp.fam.cx (malware)"; content:"|04|cccp|03|fam|02|cx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceterz.net (trojan)"; content:"|06|ceterz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cl63amgstart.ru (asprpx)"; content:"|0c|cl63amgstart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup code-scanner.com (rogue)"; content:"|0c|code-scanner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contents.mylinker.co.kr (malware)"; content:"|08|contents|08|mylinker|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corsafety.ca (zeus)"; content:"|09|corsafety|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup csqcc.net (malware)"; content:"|05|csqcc|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup datanationalmedia.com (malware)"; content:"|11|datanationalmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dbcyjnudoxk.com (neosploit)"; content:"|0b|dbcyjnudoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dex.do.am (malware)"; content:"|03|dex|02|do|02|am"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhjaozvdoxk.com (neosploit)"; content:"|0b|dhjaozvdoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dhjftzbdoxk.com (neosploit)"; content:"|0b|dhjftzbdoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diana.dti.ne.jp (malware)"; content:"|05|diana|03|dti|02|ne|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doiop.com (exploit)"; content:"|05|doiop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dottiehope.com (exploit)"; content:"|0a|dottiehope|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eldercaremedia.com (malware)"; content:"|0e|eldercaremedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup err41peerrr.co.cc (malware)"; content:"|0b|err41peerrr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup esrie.in (malware)"; content:"|05|esrie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fairplay999.tk (zeus)"; content:"|0b|fairplay999|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup farmsurvival.info (artro)"; content:"|0c|farmsurvival|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fjoty.com (malicious)"; content:"|05|fjoty|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forumz.zhaishen.com (malware)"; content:"|06|forumz|08|zhaishen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-porn-video.co.tv (malware)"; content:"|0f|free-porn-video|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gglr1.com (exploit)"; content:"|05|gglr1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ghucom.com (malware)"; content:"|06|ghucom|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grabberz.info (malware)"; content:"|08|grabberz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatinstant.net (malware)"; content:"|0c|greatinstant|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greentoparts.com (artro)"; content:"|0c|greentoparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvdwal.info (artro)"; content:"|06|hvdwal|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hybridmediaworks.com (malware)"; content:"|10|hybridmediaworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infotraff.net (malware)"; content:"|09|infotraff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j6kb3pfa.ru (artro)"; content:"|08|j6kb3pfa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kabicao.com (malware)"; content:"|07|kabicao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ksvkeocfxkiw.info (neosploit)"; content:"|0c|ksvkeocfxkiw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laafleur.com (malware)"; content:"|08|laafleur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lamcfoundation.org (exploit)"; content:"|0e|lamcfoundation|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup libc.interfree.it (malware)"; content:"|04|libc|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mcduimqmoxk.com (neosploit)"; content:"|0b|mcduimqmoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediadataworld.com (artro)"; content:"|0e|mediadataworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ml63amgstart.ru (asprpx)"; content:"|0c|ml63amgstart|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup muzemi.in (malware)"; content:"|06|muzemi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nerevi.in (malware)"; content:"|06|nerevi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nettvarts.com (artro)"; content:"|09|nettvarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup network-arts.com (artro)"; content:"|0c|network-arts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newtrii.com (zeus)"; content:"|07|newtrii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup podgorz.org (zeus)"; content:"|07|podgorz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup postfolkovs.ru (harmful)"; content:"|0b|postfolkovs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q2auv3at.ru (artro)"; content:"|08|q2auv3at|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realmediaworks.com (artro)"; content:"|0e|realmediaworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rotationweb.com (malware)"; content:"|0b|rotationweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbsgolf.contents.mylinker.co.kr (malware)"; content:"|07|sbsgolf|08|contents|08|mylinker|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanner-manufacturer.com (rogue)"; content:"|14|scanner-manufacturer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shkey.in (jdkexploit)"; content:"|05|shkey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop.tiredwolfhome.com (rogue)"; content:"|04|shop|0d|tiredwolfhome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smookusus.com (malware)"; content:"|09|smookusus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sooters.net (malware)"; content:"|07|sooters|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spowells.net (zeus)"; content:"|08|spowells|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startinmedia.com (malware)"; content:"|0c|startinmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup startprotectfilesyou.com (malware)"; content:"|14|startprotectfilesyou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup straightdirect.com (artro)"; content:"|0e|straightdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sweetartsonline.com (artro)"; content:"|0f|sweetartsonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sympathy.hdnews.net (malware)"; content:"|08|sympathy|06|hdnews|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trenublo.com (malware)"; content:"|08|trenublo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vanstarmedia.com (malware)"; content:"|0c|vanstarmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videobusiness.ru (zeus)"; content:"|0d|videobusiness|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vrera.com (artro)"; content:"|05|vrera|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicefull.ru (exploit)"; content:"|0e|webservicefull|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserviceget.ru (exploit)"; content:"|0d|webserviceget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wermaps.com (malware)"; content:"|07|wermaps|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup westmediaco.com (artro)"; content:"|0b|westmediaco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wyvbe7vg.ru (artro)"; content:"|08|wyvbe7vg|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zuo.podgorz.org (malware)"; content:"|03|zuo|07|podgorz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missing-codecs.net (malware)"; content:"|0e|missing-codecs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pietka.eu (malware)"; content:"|06|pietka|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 109438129432.cn (malware)"; content:"|0c|109438129432|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 234273849543.cn (malware)"; content:"|0c|234273849543|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 365ftf.com (malware)"; content:"|06|365ftf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 8string.ru (zeus)"; content:"|07|8string|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5m.ru (malware)"; content:"|03|a5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aeiugth84.net (zeus)"; content:"|09|aeiugth84|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusxp09.com (malware)"; content:"|0d|antivirusxp09|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ariboo.com (malicious)"; content:"|06|ariboo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ars-q.com (malware)"; content:"|05|ars-q|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b1a.ru (malware)"; content:"|03|b1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5c.ru (malware)"; content:"|03|b5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5z.ru (malware)"; content:"|03|b5z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6l.ru (malware)"; content:"|03|b6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b7g.ru (malware)"; content:"|03|b7g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8e.ru (malware)"; content:"|03|b8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bebebi.in (trojan)"; content:"|06|bebebi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benpao2020.com (malware)"; content:"|0a|benpao2020|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dahzunaeye.ru (zeus)"; content:"|0a|dahzunaeye|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dreamheartsnow.cn (malware)"; content:"|0e|dreamheartsnow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshspark.net (zeus)"; content:"|0a|freshspark|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gasdry.ru (malware)"; content:"|06|gasdry|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gemells.com (waledac)"; content:"|07|gemells|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gogotraff.cn (zeus)"; content:"|09|gogotraff|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googleanalisys.net (zeus)"; content:"|0e|googleanalisys|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googletracker.info (zeus)"; content:"|0d|googletracker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gzpf.in (malware)"; content:"|04|gzpf|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hasgsa.com (zeus)"; content:"|06|hasgsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagehut5.cn (malware)"; content:"|09|imagehut5|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jacquelinesiven.com (zeus)"; content:"|0f|jacquelinesiven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjmmmmm.cn (malware)"; content:"|07|jjmmmmm|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kannat.biz (zeus)"; content:"|06|kannat|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup livetrust.info (zeus)"; content:"|09|livetrust|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnbvicdij4uhdjb5421knnkd.com (trojan)"; content:"|18|mnbvicdij4uhdjb5421knnkd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pearch.net (harmful)"; content:"|06|pearch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solnishko999.com (zeus)"; content:"|0c|solnishko999|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teainside.net (malware)"; content:"|09|teainside|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-update.com (threat)"; content:"|0e|traffic-update|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup umniktds.ws (harmful)"; content:"|08|umniktds|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veryfinemiz.com (pdfexploit)"; content:"|0b|veryfinemiz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wannafuckme.co.cc (zeus)"; content:"|0b|wannafuckme|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aakriticraft.com (harmfuil)"; content:"|0c|aakriticraft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eachbul.com (malware)"; content:"|07|eachbul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freewebtown.com (malware)"; content:"|0b|freewebtown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thepicturehut.com (malware)"; content:"|0d|thepicturehut|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup densmail.com (malware)"; content:"|08|densmail|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2606122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jumbobestrate.cn (malware)"; content:"|0d|jumbobestrate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsotf.cn (exploit)"; content:"|09|microsotf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitepalace.com (trojan)"; content:"|0a|sitepalace|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tube84.com (malware)"; content:"|06|tube84|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup turbonamestore.cn (malware)"; content:"|0e|turbonamestore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 92shaiya.cn (0day)"; content:"|08|92shaiya|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avagujy.cn (malware)"; content:"|07|avagujy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup genantivirus.com (malware)"; content:"|0c|genantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3q.ru (harmful)"; content:"|03|a3q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a3t.ru (malware)"; content:"|03|a3t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6t.ru (malware)"; content:"|03|b6t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b76.net (malware)"; content:"|03|b76|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0catch.com (malware)"; content:"|06|0catch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 108a.com (trojan)"; content:"|04|108a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 11ad.com (malware)"; content:"|04|11ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1800laserdr.net (gumblar)"; content:"|0b|1800laserdr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 22dnf.com (malware)"; content:"|05|22dnf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 316west.com (gumblar)"; content:"|07|316west|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4ginternationaltechnology.com (gumblar)"; content:"|19|4ginternationaltechnology|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 7417788.ru (gumblar)"; content:"|07|7417788|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a-z-uebersetzer.at (gumblar)"; content:"|0f|a-z-uebersetzer|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a2-studio.com (gumblar)"; content:"|09|a2-studio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaliyahicare4u.office-on-the.net (malware)"; content:"|0e|aaliyahicare4u|0d|office-on-the|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aashaclinic.com (gumblar)"; content:"|0b|aashaclinic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abc.edu.rs (gumblar)"; content:"|03|abc|03|edu|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abdelkaoui.com (gumblar)"; content:"|0a|abdelkaoui|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abeillegourmande.com (gumblar)"; content:"|10|abeillegourmande|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acalico.com (gumblar)"; content:"|07|acalico|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup achtbanen.org (gumblar)"; content:"|09|achtbanen|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acuchillarparquetmadrid.com (gumblar)"; content:"|17|acuchillarparquetmadrid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adityatransformers.in (gumblar)"; content:"|12|adityatransformers|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adserver987.com (trojan)"; content:"|0b|adserver987|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alarmingvideos.com (malware)"; content:"|0e|alarmingvideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup albanianblogger.com (malware)"; content:"|0f|albanianblogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquarius.myvnc.com (malware)"; content:"|08|aquarius|05|myvnc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atuttascuola.it (exploit)"; content:"|0c|atuttascuola|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avscaner-35pr.co.cc (harmful)"; content:"|0d|avscaner-35pr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aysport.net (exploit)"; content:"|07|aysport|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bahed.in (malware)"; content:"|05|bahed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baidu.cn.wwvv.us (malware)"; content:"|05|baidu|02|cn|04|wwvv|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbrfinlex.pl (exploit)"; content:"|09|bbrfinlex|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestlitevideo.cn (malware)"; content:"|0d|bestlitevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigtopstats.cn (malware)"; content:"|0b|bigtopstats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup birio.in (malware)"; content:"|05|birio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmlsk.com (malware)"; content:"|05|bmlsk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookdances.com (malware)"; content:"|0a|bookdances|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booklist.co.kr (malware)"; content:"|08|booklist|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brandbox.org.ua (exploit)"; content:"|08|brandbox|03|org|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bunnyclub.tv (koobface)"; content:"|09|bunnyclub|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c1z.ru (malware)"; content:"|03|c1z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup c7r.ru (malware)"; content:"|03|c7r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup canadianmedworld.com (pdfexploit)"; content:"|10|canadianmedworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ccitg.org (exploit)"; content:"|05|ccitg|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cetere.biz (trojan)"; content:"|06|cetere|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cetere.net (malware)"; content:"|06|cetere|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cfteam.net (harmful)"; content:"|06|cfteam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ckt4.cn (0day)"; content:"|04|ckt4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleartomix.com (malware)"; content:"|0a|cleartomix|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup click.fool.com (exploit)"; content:"|05|click|04|fool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup collectionerrorreport.com (malware)"; content:"|15|collectionerrorreport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup contentpremium.biz (malware)"; content:"|0e|contentpremium|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolnamemart.cn (malware)"; content:"|0c|coolnamemart|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coopen.cn (malware)"; content:"|06|coopen|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crwye.cn (trojan)"; content:"|05|crwye|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutheatergroup.cn (malware)"; content:"|0e|cutheatergroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cyber-crackerz.net (malware)"; content:"|0e|cyber-crackerz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dermidom44.ru (exploit)"; content:"|0a|dermidom44|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup domainameat.cc (exploit)"; content:"|0b|domainameat|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drelshazly.com (exploit)"; content:"|0a|drelshazly|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvaita.org (malware)"; content:"|06|dvaita|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e4578.com (malware)"; content:"|05|e4578|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e5732.com (malware)"; content:"|05|e5732|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enthusiasticwin.com (malware)"; content:"|0f|enthusiasticwin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup favell35td.co.cc (exploit)"; content:"|0a|favell35td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup forwardizm.com (malware)"; content:"|0a|forwardizm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frame-traffic.in (exploit)"; content:"|0d|frame-traffic|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freebsdadministrator.info (malware)"; content:"|14|freebsdadministrator|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geogoogle.org (pdfexploit)"; content:"|09|geogoogle|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gggmc.cn (exploit)"; content:"|05|gggmc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glory4.co.cc (exploit)"; content:"|06|glory4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analyti.com (exploit)"; content:"|0e|google-analyti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gpwg.ws (exploit)"; content:"|04|gpwg|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hrmsconsulting.com (malware)"; content:"|0e|hrmsconsulting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hsifoto.no (exploit)"; content:"|07|hsifoto|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hxlcsc.com (exploit)"; content:"|06|hxlcsc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iexam.info (harmful)"; content:"|05|iexam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup image-bucket.us (malware)"; content:"|0c|image-bucket|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imoncall.com (malware)"; content:"|08|imoncall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inclabtec.biz (exploit)"; content:"|09|inclabtec|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indofamily.net (harmful)"; content:"|0a|indofamily|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup insed.in (malware)"; content:"|05|insed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup instantresaletemplates1.com (harmful)"; content:"|17|instantresaletemplates1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwillhavebigdick.com (malware)"; content:"|10|iwillhavebigdick|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup javasunupdate.info (malware)"; content:"|0d|javasunupdate|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jobos.in (trojan)"; content:"|05|jobos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ke86.com (exploit)"; content:"|04|ke86|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kindsms.com (exploit)"; content:"|07|kindsms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kkspp.com (trojan)"; content:"|05|kkspp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kobo.com.ua (exploit)"; content:"|04|kobo|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loikk.lv (harmful)"; content:"|05|loikk|02|lv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup machinevideo.net (malware)"; content:"|0c|machinevideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mesutduman.com (worm)"; content:"|0a|mesutduman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mg5b.info (rogue)"; content:"|04|mg5b|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoftupdateserver.org (trojan)"; content:"|15|microsoftupdateserver|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mixgrouptravel.cn (malware)"; content:"|0e|mixgrouptravel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mnobabla.ru (trojan)"; content:"|08|mnobabla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myyes104.com (gumblar)"; content:"|08|myyes104|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naios.in (malware)"; content:"|05|naios|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neirong.funshion.com (malware)"; content:"|07|neirong|08|funshion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpoint.kr (malware)"; content:"|08|newpoint|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup notglum.com (exploit)"; content:"|07|notglum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup npshare.de (worm)"; content:"|07|npshare|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ocmmonview.com (malware)"; content:"|0a|ocmmonview|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmot.in (malware)"; content:"|05|osmot|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pered.in (malware)"; content:"|05|pered|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pogoaliceadvance.com (malware)"; content:"|10|pogoaliceadvance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornoseven.com (threat)"; content:"|0a|pornoseven|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prettydota.net (malware)"; content:"|0a|prettydota|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup raminoroyal.eu (malware)"; content:"|0b|raminoroyal|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramiroyal.fr (malware)"; content:"|09|ramiroyal|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rapiddownloads.eu (malware)"; content:"|0e|rapiddownloads|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup roziy28.fileave.com (malware)"; content:"|07|roziy28|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rummyroyal.com (malware)"; content:"|0a|rummyroyal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s41.hotfile.com (malware)"; content:"|03|s41|07|hotfile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup santrast-oth.com (malware)"; content:"|0c|santrast-oth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saudi-marka.net (gumblar)"; content:"|0b|saudi-marka|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sharonstender.com (malware)"; content:"|0d|sharonstender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shasanguo.com (malware)"; content:"|09|shasanguo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sidevladi.com (malware)"; content:"|09|sidevladi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyefenton.com (malware)"; content:"|0a|skyefenton|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strek.co.th (trojan)"; content:"|05|strek|02|co|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup strikeall.ru (harmful)"; content:"|09|strikeall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teenhitchat.com (exploit)"; content:"|0b|teenhitchat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup top100animalclips.in (malware)"; content:"|11|top100animalclips|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbesttvs.com (gumblar)"; content:"|0a|topbesttvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup totalworldmusic.com (exploit)"; content:"|0f|totalworldmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-monitoring.com (malware)"; content:"|12|traffic-monitoring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tygh.interfree.it (malware)"; content:"|04|tygh|09|interfree|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0g.ru (exploit)"; content:"|03|u0g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0i.ru (exploit)"; content:"|03|u0i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0y.ru (exploit)"; content:"|03|u0y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0z.ru (exploit)"; content:"|03|u0z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1q.ru (exploit)"; content:"|03|u1q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1r.ru (exploit)"; content:"|03|u1r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3p.ru (exploit)"; content:"|03|u3p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u3q.ru (exploit)"; content:"|03|u3q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5i.ru (exploit)"; content:"|03|u5i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5j.ru (exploit)"; content:"|03|u5j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5z.ru (exploit)"; content:"|03|u5z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update.dashtec.net (trojan)"; content:"|06|update|07|dashtec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uy3.ru (exploit)"; content:"|03|uy3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vegaslive24.com (exploit)"; content:"|0b|vegaslive24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vork.in (harmful)"; content:"|04|vork|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv04.info (trojan)"; content:"|04|vv04|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xbctdvpxoxk.com (exploit)"; content:"|0b|xbctdvpxoxk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xennagame.ru (exploit)"; content:"|09|xennagame|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xunjie.com (malware)"; content:"|06|xunjie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xunlei100.com (trojan)"; content:"|09|xunlei100|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xuterpo.ru (exploit)"; content:"|07|xuterpo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xx7.in (worm)"; content:"|03|xx7|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youtring.com (harmful)"; content:"|08|youtring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zulk.in (harmful)"; content:"|04|zulk|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1st-movies.org (malware)"; content:"|0a|1st-movies|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 34i5uhf.net (malware)"; content:"|07|34i5uhf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abujablog.com (threat)"; content:"|09|abujablog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adaichaepo.ru (fastflux)"; content:"|0a|adaichaepo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup afgekrop.com (malware)"; content:"|08|afgekrop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aftui.in (malicious)"; content:"|05|aftui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aimauto.org (gumblar)"; content:"|07|aimauto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup air-bt.ru (gumblar)"; content:"|06|air-bt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almodial.co.cc (malicious)"; content:"|08|almodial|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup annonce-rallye.com (threat)"; content:"|0e|annonce-rallye|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anti-malware-gold.com (malicious)"; content:"|11|anti-malware-gold|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avalonx.info (malware)"; content:"|07|avalonx|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avedaliving.com (malware)"; content:"|0b|avedaliving|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8o.ru (malware)"; content:"|03|b8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b9g.ru (malware)"; content:"|03|b9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-scanner-2010.com (malicious)"; content:"|11|best-scanner-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-tube-world.com (malicious)"; content:"|0f|best-tube-world|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bigeasyarts.com (artro)"; content:"|0b|bigeasyarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broachbn92.info (harmful)"; content:"|0a|broachbn92|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brushcourt.com (fastflux)"; content:"|0a|brushcourt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cassandrarice.com (malware)"; content:"|0d|cassandrarice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceterx.com (malicious)"; content:"|06|ceterx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup charter-x.biz (malware)"; content:"|09|charter-x|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clairebowin.com (malware)"; content:"|0b|clairebowin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clear-great-tube.com (malicious)"; content:"|10|clear-great-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clear-web-tube.com (malicious)"; content:"|0e|clear-web-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup colleynadanler.com (malware)"; content:"|0e|colleynadanler|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup commercematch.biz (malware)"; content:"|0d|commercematch|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compressyourmortgage.com (malicious)"; content:"|14|compressyourmortgage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decideonline.com (malware)"; content:"|0c|decideonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup docsxmad.com (malware)"; content:"|08|docsxmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadmoviesddl.com (malware)"; content:"|11|downloadmoviesddl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drpepi.com (malicious)"; content:"|06|drpepi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dukhi.co.uk (malicious)"; content:"|05|dukhi|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecountertracker.cc (malware)"; content:"|0f|ecountertracker|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edisonsbar.com (malware)"; content:"|0a|edisonsbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enstatcounter.net (malware)"; content:"|0d|enstatcounter|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscan14pd.co.cc (malicious)"; content:"|0c|fastscan14pd|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fiiegoogle.com (malware)"; content:"|0a|fiiegoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fortraffic001.com (malware)"; content:"|0d|fortraffic001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fortraffic020.com (malware)"; content:"|0d|fortraffic020|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fqtxmad.com (malware)"; content:"|07|fqtxmad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freese-x.net (malicious)"; content:"|08|freese-x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ftpadobe.com (malware)"; content:"|08|ftpadobe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getfreshflower.com (threat)"; content:"|0e|getfreshflower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornavi.info (malware)"; content:"|0b|gigapornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornclip.info (malware)"; content:"|0c|gigapornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornfilm.info (malware)"; content:"|0c|gigapornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornkino.info (malware)"; content:"|0c|gigapornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornmov.info (malware)"; content:"|0b|gigapornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornmovie.info (malware)"; content:"|0d|gigapornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornmpeg.info (malware)"; content:"|0c|gigapornmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornrolik.info (malware)"; content:"|0d|gigapornrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornvid.info (malware)"; content:"|0b|gigapornvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gigapornvideo.info (malware)"; content:"|0d|gigapornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornavi.info (malware)"; content:"|0b|girlpornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornclip.info (malware)"; content:"|0c|girlpornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornfilm.info (malware)"; content:"|0c|girlpornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornkino.info (malware)"; content:"|0c|girlpornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornmov.info (malware)"; content:"|0b|girlpornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornmovie.info (malware)"; content:"|0d|girlpornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornmpeg.info (malware)"; content:"|0c|girlpornmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornrolik.info (malware)"; content:"|0d|girlpornrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornvid.info (malware)"; content:"|0b|girlpornvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlpornvideo.info (malware)"; content:"|0d|girlpornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexavi.info (malware)"; content:"|0a|girlsexavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexclip.info (malware)"; content:"|0b|girlsexclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexfilm.info (malware)"; content:"|0b|girlsexfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexkino.info (malware)"; content:"|0b|girlsexkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexmov.info (malware)"; content:"|0a|girlsexmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexmovie.info (malware)"; content:"|0c|girlsexmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexmpeg.info (malware)"; content:"|0b|girlsexmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexrolik.info (malware)"; content:"|0c|girlsexrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexvid.info (malware)"; content:"|0a|girlsexvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlsexvideo.info (malware)"; content:"|0c|girlsexvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxavi.info (malware)"; content:"|08|girlxavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxclip.info (malware)"; content:"|09|girlxclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxkino.info (malware)"; content:"|09|girlxkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxmov.info (malware)"; content:"|08|girlxmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxmpeg.info (malware)"; content:"|09|girlxmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxrolik.info (malware)"; content:"|0a|girlxrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxavi.info (malware)"; content:"|0a|girlxxxavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxclip.info (malware)"; content:"|0b|girlxxxclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxfilm.info (malware)"; content:"|0b|girlxxxfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxkino.info (malware)"; content:"|0b|girlxxxkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxmov.info (malware)"; content:"|0a|girlxxxmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxmovie.info (malware)"; content:"|0c|girlxxxmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxmpeg.info (malware)"; content:"|0b|girlxxxmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxrolik.info (malware)"; content:"|0c|girlxxxrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxvid.info (malware)"; content:"|0a|girlxxxvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup girlxxxvideo.info (malware)"; content:"|0c|girlxxxvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup globalprotectionservices.com (malicious)"; content:"|18|globalprotectionservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodndservice.net (malware)"; content:"|0d|goodndservice|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodsite.in (malicious)"; content:"|08|goodsite|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-advertiseng.com (malware)"; content:"|12|google-advertiseng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-analyzer.com (malware)"; content:"|0f|google-analyzer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlewinads.com (malware)"; content:"|0c|googlewinads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlewinsecurity.com (malware)"; content:"|11|googlewinsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumrahee.com (malware)"; content:"|08|gumrahee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumrahee.net (malware)"; content:"|08|gumrahee|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gumrahee.org (malware)"; content:"|08|gumrahee|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h45h45t9.com (fastflux)"; content:"|08|h45h45t9|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexavi.info (malware)"; content:"|0a|hellsexavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexclip.info (malware)"; content:"|0b|hellsexclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexfilm.info (malware)"; content:"|0b|hellsexfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexkino.info (malware)"; content:"|0b|hellsexkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexmov.info (malware)"; content:"|0a|hellsexmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexmovie.info (malware)"; content:"|0c|hellsexmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexmpeg.info (malware)"; content:"|0b|hellsexmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexrolik.info (malware)"; content:"|0c|hellsexrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexvid.info (malware)"; content:"|0a|hellsexvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellsexvideo.info (malware)"; content:"|0c|hellsexvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxavi.info (malware)"; content:"|08|hellxavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxclip.info (malware)"; content:"|09|hellxclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxfilm.info (malware)"; content:"|09|hellxfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxkino.info (malware)"; content:"|09|hellxkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxmov.info (malware)"; content:"|08|hellxmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxmovie.info (malware)"; content:"|0a|hellxmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxmpeg.info (malware)"; content:"|09|hellxmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxrolik.info (malware)"; content:"|0a|hellxrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxvid.info (malware)"; content:"|08|hellxvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hellxvideo.info (malware)"; content:"|0a|hellxvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hostermykz.com (malware)"; content:"|0a|hostermykz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornavi.info (malware)"; content:"|0a|hotpornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornclip.info (malware)"; content:"|0b|hotpornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornfilm.info (malware)"; content:"|0b|hotpornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornkino.info (malware)"; content:"|0b|hotpornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornmov.info (malware)"; content:"|0a|hotpornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornmpeg.info (malware)"; content:"|0b|hotpornmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornrolik.info (malware)"; content:"|0c|hotpornrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornvid.info (malware)"; content:"|0a|hotpornvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotpornvideo.info (malware)"; content:"|0c|hotpornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iaquarium.net (threat)"; content:"|09|iaquarium|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inforam.org (malware)"; content:"|07|inforam|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup isptoolbar.net (malware)"; content:"|0a|isptoolbar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iwcsheizuqkc.com (malicious)"; content:"|0c|iwcsheizuqkc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j82347236.cn (zeus)"; content:"|09|j82347236|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jennycalamia.com (malware)"; content:"|0c|jennycalamia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jimmhobbyrus.ru (malicious)"; content:"|0c|jimmhobbyrus|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johannawelch.com (malware)"; content:"|0c|johannawelch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jsonphp.net (fastflux)"; content:"|07|jsonphp|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup julesberner.com (malware)"; content:"|0b|julesberner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanabus.eu (malicious)"; content:"|07|kanabus|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lenta-rss.com (malware)"; content:"|09|lenta-rss|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lifetimewebaddress.com (malicious)"; content:"|12|lifetimewebaddress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveinterneta.info (malware)"; content:"|0d|liveinterneta|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveinternit.com (malware)"; content:"|0c|liveinternit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liveintirnet.com (malware)"; content:"|0c|liveintirnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lovewowlist.com (malware)"; content:"|0b|lovewowlist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediacenterusa.com (malicious)"; content:"|0e|mediacenterusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediafeelinfo.com (malicious)"; content:"|0d|mediafeelinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mega-scan-pc-new14.net (malicious)"; content:"|12|mega-scan-pc-new14|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup member-tube.com (malicious)"; content:"|0b|member-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-dns.com (malicious)"; content:"|0d|microsoft-dns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup milowfan.com (malicious)"; content:"|08|milowfan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mir-krossover.com (malware)"; content:"|0d|mir-krossover|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miranda.gov.ve (malicious)"; content:"|07|miranda|03|gov|02|ve"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mizotizo.info (malware)"; content:"|08|mizotizo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mmslive.info (malware)"; content:"|07|mmslive|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup modern-tube.net (malicious)"; content:"|0b|modern-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moneyandex.ru (malware)"; content:"|0a|moneyandex|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup motuh.com (artro)"; content:"|05|motuh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mvbest.cn (malware)"; content:"|06|mvbest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myldxrz.com (malware)"; content:"|07|myldxrz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mynudenetwork.com (malicious)"; content:"|0d|mynudenetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornavi.info (malware)"; content:"|09|mypornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornclip.info (malware)"; content:"|0a|mypornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornfilm.info (malware)"; content:"|0a|mypornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornkino.info (malware)"; content:"|0a|mypornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornmov.info (malware)"; content:"|09|mypornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornmovie.info (malware)"; content:"|0b|mypornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornmpeg.info (malware)"; content:"|0a|mypornmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornrolik.info (malware)"; content:"|0b|mypornrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypornvid.info (malware)"; content:"|09|mypornvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neorealmedia.com (malicious)"; content:"|0c|neorealmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-xmading.ru (malware)"; content:"|0b|new-xmading|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornavi.info (malware)"; content:"|0a|newpornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornclip.info (malware)"; content:"|0b|newpornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornfilm.info (malware)"; content:"|0b|newpornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornkino.info (malware)"; content:"|0b|newpornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornmov.info (malware)"; content:"|0a|newpornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornmovie.info (malware)"; content:"|0c|newpornmovie|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornmpeg.info (malware)"; content:"|0b|newpornmpeg|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornrolik.info (malware)"; content:"|0c|newpornrolik|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornvid.info (malware)"; content:"|0a|newpornvid|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newpornvideo.info (malware)"; content:"|0c|newpornvideo|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nhplm.org (malicious)"; content:"|05|nhplm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuzi.com.cn (malicious)"; content:"|04|nuzi|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup office-on-the.net (phishing)"; content:"|0d|office-on-the|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oncokq.com (malware)"; content:"|06|oncokq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onicemano.in (malware)"; content:"|09|onicemano|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polkj.com (malicious)"; content:"|05|polkj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup popclick.net (malware)"; content:"|08|popclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pornopornofilm.info (malware)"; content:"|0e|pornopornofilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup porntube-now.com (malicious)"; content:"|0c|porntube-now|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prospanx2.com (malware)"; content:"|09|prospanx2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup protect003.com (malicious)"; content:"|0a|protect003|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prufung-authentizitat.com (malware)"; content:"|15|prufung-authentizitat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup quickloadvideo.com (malicious)"; content:"|0e|quickloadvideo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup razdacha.biz (malware)"; content:"|08|razdacha|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rofl11.co.cc (malicious)"; content:"|06|rofl11|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rokmc541.co.kr (malicious)"; content:"|08|rokmc541|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rooltrgoogle.com (malware)"; content:"|0c|rooltrgoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup royalbio.net (malicious)"; content:"|08|royalbio|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rsa-rss.org (malware)"; content:"|07|rsa-rss|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruddersathome.com (threat)"; content:"|0d|ruddersathome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sakjt3r5a.com (malware)"; content:"|09|sakjt3r5a|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup savadacu4.co.cc (malicious)"; content:"|09|savadacu4|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdlls.ru (fastflux)"; content:"|05|sdlls|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sltgoogle.com (malware)"; content:"|09|sltgoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sltzgoogle.com (malware)"; content:"|0a|sltzgoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartenergymodel.info (malware)"; content:"|10|smartenergymodel|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartenergymodel.net (malware)"; content:"|10|smartenergymodel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup softwarecracksonlineddl.com (malware)"; content:"|17|softwarecracksonlineddl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup starsico.ru (malicious)"; content:"|08|starsico|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statcounter.cc (malware)"; content:"|0b|statcounter|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunclear5.co.cc (malicious)"; content:"|09|sunclear5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suoer-mego-tubes.com (malicious)"; content:"|10|suoer-mego-tubes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-cool-tube.net (malicious)"; content:"|0f|super-cool-tube|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup super-tubes-mego.com (malicious)"; content:"|10|super-tubes-mego|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tandaclinicalmonitoring.com (threat)"; content:"|17|tandaclinicalmonitoring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teleffonov.net (malware)"; content:"|0a|teleffonov|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themosquitoking.com (threat)"; content:"|0f|themosquitoking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup time2befree.biz (malware)"; content:"|0b|time2befree|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafficbiztds.com (malware)"; content:"|0d|trafficbiztds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup treecorn.ru (malware)"; content:"|08|treecorn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u-2me.info (malware)"; content:"|05|u-2me|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ubuuntu.info (malware)"; content:"|07|ubuuntu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unb0rn.org (malware)"; content:"|06|unb0rn|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup undarkmetal.net (malicious)"; content:"|0b|undarkmetal|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-windows7.com (malware)"; content:"|0f|update-windows7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usapornclips.com (malicious)"; content:"|0c|usapornclips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup varxx.com (malware)"; content:"|05|varxx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veresgood.com (malware)"; content:"|09|veresgood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vipcodec.net (malicious)"; content:"|08|vipcodec|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippornavi.info (malware)"; content:"|0a|vippornavi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippornclip.info (malware)"; content:"|0b|vippornclip|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippornfilm.info (malware)"; content:"|0b|vippornfilm|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippornkino.info (malware)"; content:"|0b|vippornkino|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vippornmov.info (malware)"; content:"|0a|vippornmov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visitstats.net (malware)"; content:"|0a|visitstats|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vvxxn.com (malware)"; content:"|05|vvxxn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup windowexpodfw.com (malicious)"; content:"|0d|windowexpodfw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winupdatedll.com (malware)"; content:"|0c|winupdatedll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wvg7.cn (0day)"; content:"|04|wvg7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmadinst.com (malware)"; content:"|08|xmadinst|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xmadinst.info (malware)"; content:"|08|xmadinst|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yandexsecurity.com (malware)"; content:"|0e|yandexsecurity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yasetai.com (malware)"; content:"|07|yasetai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regclean.com (rogue)"; content:"|08|regclean|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2616932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zos.lua.pl (harmful)"; content:"|03|zos|03|lua|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1000waystocheat.com (malware)"; content:"|0f|1000waystocheat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 222233.com (malware)"; content:"|06|222233|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup acurrucareis.com (harmful)"; content:"|0c|acurrucareis|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adserver8.fileave.com (malware)"; content:"|09|adserver8|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup albi.co.jp (harmful)"; content:"|04|albi|02|co|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alex0088.com (harmful)"; content:"|08|alex0088|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alexandepeggy.com (harmful)"; content:"|0d|alexandepeggy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alicantedirectorio.com (malware)"; content:"|12|alicantedirectorio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alierdogan.web.tr (harmful)"; content:"|0a|alierdogan|03|web|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alkte.com (harmful)"; content:"|05|alkte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allnaturalpornstars.com (harmful)"; content:"|13|allnaturalpornstars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup am4u.kr (harmful)"; content:"|04|am4u|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsolution20-td.co.cc (threat)"; content:"|0f|avsolution20-td|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bastardisabelle.com (malware)"; content:"|0f|bastardisabelle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup celebsvidz.net (malware)"; content:"|0a|celebsvidz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clicalbum.com (malware)"; content:"|09|clicalbum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cutewizard.com (malware)"; content:"|0a|cutewizard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup derijablia.com (zeus)"; content:"|0a|derijablia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadmovie.me (malware)"; content:"|0d|downloadmovie|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dvdrippers.org (malware)"; content:"|0a|dvdrippers|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e58z.cn (kneber_zeus)"; content:"|04|e58z|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup easyipodmovies.com (malware)"; content:"|0e|easyipodmovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edsse.com (malware)"; content:"|05|edsse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emetv.es (malware)"; content:"|05|emetv|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eurelectrics.com (zeus)"; content:"|0c|eurelectrics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extralargevideos.com (malware)"; content:"|10|extralargevideos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eyesong.ru (threat)"; content:"|07|eyesong|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fileformatutilities.com (malware)"; content:"|13|fileformatutilities|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flighttesttech.com (malware)"; content:"|0e|flighttesttech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gbsup.com (malware)"; content:"|05|gbsup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup get.setheo.com (malware)"; content:"|03|get|06|setheo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup h14.pl (harmful)"; content:"|03|h14|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hot4youxxx.in (malware)"; content:"|0a|hot4youxxx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hvpm.org (harmful)"; content:"|04|hvpm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hztian.com (artro)"; content:"|06|hztian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup i-love-ppi.info (malware)"; content:"|0a|i-love-ppi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup icelemon.net (malware)"; content:"|08|icelemon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ieupdate.conduit.com (malware)"; content:"|08|ieupdate|07|conduit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iglesiabetania1.com (malware)"; content:"|0f|iglesiabetania1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup img5.ihaberadserver.com (malware)"; content:"|04|img5|0e|ihaberadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup komikshero.com (zeus)"; content:"|0a|komikshero|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loveaz.biz (harmful)"; content:"|06|loveaz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzasm.hotbox.ru (threat)"; content:"|05|lzasm|06|hotbox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup microsoft-spynet.com (malware)"; content:"|10|microsoft-spynet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mileywiz1.fileave.com (malware)"; content:"|09|mileywiz1|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moreig.com (artro)"; content:"|06|moreig|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nzell.com (malware)"; content:"|05|nzell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oksave9.co.cc (rogue)"; content:"|07|oksave9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup online.antivirus-on-line.net (malware)"; content:"|06|online|11|antivirus-on-line|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phonesquare.com (malware)"; content:"|0b|phonesquare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pplive.com (malware)"; content:"|06|pplive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registaroem.net (zeus)"; content:"|0b|registaroem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup reisianimalporn.in (malware)"; content:"|0f|reisianimalporn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renatamiranda.com.br (threat)"; content:"|0d|renatamiranda|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup resumato2010.com (malware)"; content:"|0c|resumato2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-monitoring-3.in (malware)"; content:"|11|safe-monitoring-3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safespace58.org (malware)"; content:"|0b|safespace58|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchits.org (malware)"; content:"|09|searchits|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup serveradobe.co.cc (threat)"; content:"|0b|serveradobe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sinairport.com (artro)"; content:"|0a|sinairport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spr1.net (harmful)"; content:"|04|spr1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywarecease.com (malware)"; content:"|0c|spywarecease|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spywareglossary.com (malware)"; content:"|0f|spywareglossary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statusokna.ru (threat)"; content:"|0a|statusokna|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup streetrodsnow.com (threat)"; content:"|0d|streetrodsnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theambition.com (threat)"; content:"|0b|theambition|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup todaybestfreeporn.in (malware)"; content:"|11|todaybestfreeporn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tunemug.ru (bredolab)"; content:"|07|tunemug|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tuzonavirtual.com (harmful)"; content:"|0d|tuzonavirtual|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup utling.com (artro)"; content:"|06|utling|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vargasmarques.com (threat)"; content:"|0d|vargasmarques|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videoinfoline.com (malware)"; content:"|0d|videoinfoline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wattoo.biz (harmful)"; content:"|06|wattoo|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whitakermedical.com (malware)"; content:"|0f|whitakermedical|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxiac.in (malware)"; content:"|05|yxiac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zglwfb.com (malware)"; content:"|06|zglwfb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zhongguojiu.cn (threat)"; content:"|0b|zhongguojiu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zine.com.au (harmful)"; content:"|04|zine|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flash-codec.com (malware)"; content:"|0b|flash-codec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup illusionfest.ru (iframe)"; content:"|0c|illusionfest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ltkq.in (malware)"; content:"|04|ltkq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noplit.ws (malware)"; content:"|06|noplit|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u0c.ru (malware)"; content:"|03|u0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u1b.ru (malware)"; content:"|03|u1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u5c.ru (malware)"; content:"|03|u5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updatedate.cn (threat)"; content:"|0a|updatedate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2288.org (harmful)"; content:"|04|2288|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 50checkingyourtraffic.com (rogue)"; content:"|15|50checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6600.org (malware)"; content:"|04|6600|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a0v.org (injection)"; content:"|03|a0v|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad.ghura.pl (malware)"; content:"|02|ad|05|ghura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adware-2010.com (rogue)"; content:"|0b|adware-2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwarebot.com (rogue)"; content:"|09|adwarebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agoraagora.dominiotemporario.com (trojan)"; content:"|0a|agoraagora|11|dominiotemporario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agradomhome109.com (zeus)"; content:"|0e|agradomhome109|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alkarting.com (malicious)"; content:"|09|alkarting|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amusecity.com (gumblar)"; content:"|09|amusecity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirglass.com (rogue)"; content:"|0c|antivirglass|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirus-on-line.net (malicious)"; content:"|11|antivirus-on-line|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anvietmedia.com (gumblar)"; content:"|0b|anvietmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup apadanagroups.ir (gumblar)"; content:"|0d|apadanagroups|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ar-global.com (gumblar)"; content:"|09|ar-global|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup areasdm.com.ar (gumblar)"; content:"|07|areasdm|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arekosicki.com (gumblar)"; content:"|0a|arekosicki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup artalepwellness.com (gumblar)"; content:"|0f|artalepwellness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assiouty-group.com (gumblar)"; content:"|0e|assiouty-group|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup assurline.fr (gumblar)"; content:"|09|assurline|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atelieray.com (gumblar)"; content:"|09|atelieray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atmar.com.pl (malicious)"; content:"|05|atmar|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aurvedayogacenter.ws (malware)"; content:"|11|aurvedayogacenter|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup averiwarefree.com (gumblar)"; content:"|0d|averiwarefree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avj.co.in (gumblar)"; content:"|03|avj|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avsolution42.co.cc (malicious)"; content:"|0c|avsolution42|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b23.ru (rogue)"; content:"|03|b23|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bangkokfood.com (gumblar)"; content:"|0b|bangkokfood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bantontan.com (gumblar)"; content:"|09|bantontan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barista-italiano.nl (gumblar)"; content:"|10|barista-italiano|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup basicasco.ru (zeus)"; content:"|09|basicasco|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bcs-construct.be (gumblar)"; content:"|0d|bcs-construct|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellsdirectory.com (gumblar)"; content:"|0e|bellsdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellsworld.com (gumblar)"; content:"|0a|bellsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bengos.ro (malicious)"; content:"|06|bengos|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-online2.com (rogue)"; content:"|0c|best-online2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestinporn.com (gumblar)"; content:"|0a|bestinporn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestlavori.com (gumblar)"; content:"|0a|bestlavori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestway.cz (gumblar)"; content:"|07|bestway|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bharticouncil.com (harmful)"; content:"|0d|bharticouncil|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup big-push2010.com (zeus)"; content:"|0c|big-push2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup billivilli.co.cc (rogue)"; content:"|0a|billivilli|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blabladsmmdedvv.com (zeus)"; content:"|0f|blabladsmmdedvv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackcreekstudios.com (gumblar)"; content:"|11|blackcreekstudios|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blschd.com (gumblar)"; content:"|06|blschd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bluestateing.com (malicious)"; content:"|0c|bluestateing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmplaces.msk.ru (gumblar)"; content:"|08|bmplaces|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bmwci.yaad.net (exploit)"; content:"|05|bmwci|04|yaad|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bobscopy.ca (gumnlar)"; content:"|08|bobscopy|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bookav.net (gumblar)"; content:"|06|bookav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup business.one.strangled.net (rogue)"; content:"|08|business|03|one|09|strangled|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buterflu.com (malicious)"; content:"|08|buterflu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceterv.com (exploit)"; content:"|06|ceterv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceterv.net (pdfexploit)"; content:"|06|ceterv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup citbun.com (malicious)"; content:"|06|citbun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classicmotornews.com (malicious)"; content:"|10|classicmotornews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clocktribuh.biz (malicious)"; content:"|0b|clocktribuh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cobrap.org.br (malicious)"; content:"|06|cobrap|03|org|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup config.shopperreports.com (malware)"; content:"|06|config|0e|shopperreports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coundnes.com (spyeye)"; content:"|08|coundnes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup counter100.in (exploit)"; content:"|0a|counter100|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crimepayz.org (backdoor)"; content:"|09|crimepayz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cybercartel.biz (zeus)"; content:"|0b|cybercartel|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dasafa.info (neosploit)"; content:"|06|dasafa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup decorum76.info (exploit)"; content:"|09|decorum76|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deecohngahphichaehaethoo.com (zeus)"; content:"|18|deecohngahphichaehaethoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup delicioushistory.com (malicious)"; content:"|10|delicioushistory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalmediasonic.com (malicious)"; content:"|11|digitalmediasonic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dlkasfgatker.com (exploit)"; content:"|0c|dlkasfgatker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dotroot.tk (rogue)"; content:"|07|dotroot|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drain-brain2.com (zeus)"; content:"|0c|drain-brain2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e2an.com (threat)"; content:"|04|e2an|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e2gh.com (threat)"; content:"|04|e2gh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ejih.org (threat)"; content:"|04|ejih|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electronicbillingonline.net (malware)"; content:"|17|electronicbillingonline|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euronicsit.com (malicious)"; content:"|0a|euronicsit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extraditelbds.info (exploit)"; content:"|0d|extraditelbds|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fegoo.in (malicious)"; content:"|05|fegoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fgawegwr.chez.com (trojan)"; content:"|08|fgawegwr|04|chez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fillfree22.co.cc (malicious)"; content:"|0a|fillfree22|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashupdate.co.cc (malicious)"; content:"|0b|flashupdate|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup for-sunny-se.com (malware)"; content:"|0c|for-sunny-se|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fpcc.biz (zeus)"; content:"|04|fpcc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup francireshar.com (exploit)"; content:"|0c|francireshar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fredericfransen.com (zeus)"; content:"|0f|fredericfransen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freshsummer.ru (malware)"; content:"|0b|freshsummer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup futiruofucic.gotdns.com (malicious)"; content:"|0c|futiruofucic|06|gotdns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g3vrv3rveverfsd.tw (zeus)"; content:"|0f|g3vrv3rveverfsd|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup getload.in (malicious)"; content:"|07|getload|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggooggle.net (zeus)"; content:"|08|ggooggle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goforsecurity4.com (threat)"; content:"|0e|goforsecurity4|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup great-tube-home.com (malware)"; content:"|0f|great-tube-home|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guardi4n.webs.com (malicious)"; content:"|08|guardi4n|04|webs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup heisthat.biz (zeus)"; content:"|08|heisthat|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hilaryblog.x10.bz (malicious)"; content:"|0a|hilaryblog|03|x10|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homefitness.it (threat)"; content:"|0b|homefitness|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hosting-king.net (zeus)"; content:"|0c|hosting-king|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huyqvpeotwyn.com (neosploit)"; content:"|0c|huyqvpeotwyn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iffik.asia (zeus)"; content:"|05|iffik|04|asia"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iliil.ru (zeus)"; content:"|05|iliil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup in6cs.com (malicious)"; content:"|05|in6cs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infoglobalsolutions.com (malicious)"; content:"|13|infoglobalsolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup interinar.com (malicious)"; content:"|09|interinar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intsd.in (exploit)"; content:"|05|intsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iveeteepew.ru (zeus)"; content:"|0a|iveeteepew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iweblandersmore.com (exploit)"; content:"|0f|iweblandersmore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jenaallee.com (exploit)"; content:"|09|jenaallee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jjaa.ru (zeus)"; content:"|04|jjaa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jkk.tw (malware)"; content:"|03|jkk|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jp20100530vio.webcindario.com (trojan)"; content:"|0d|jp20100530vio|0b|webcindario|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup juggle.com (malicious)"; content:"|06|juggle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ketengahholding.com.my (malicious)"; content:"|0f|ketengahholding|03|com|02|my"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup keysmbol.com (malicious)"; content:"|08|keysmbol|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingdomqw.com (malicious)"; content:"|09|kingdomqw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kjjm.biz (zeus)"; content:"|04|kjjm|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kursovie.org.ru (zeus)"; content:"|08|kursovie|03|org|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linkbuilding.nl (zeus)"; content:"|0c|linkbuilding|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup listwowgame.com (zeus)"; content:"|0b|listwowgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lyuboidomen.net (zeus)"; content:"|0b|lyuboidomen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup madeninba.com (trojan)"; content:"|09|madeninba|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicvideoonline.in (exploit)"; content:"|10|magicvideoonline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup managna.com (spyeye)"; content:"|07|managna|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup megatuz.ru (zeus)"; content:"|07|megatuz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup minijuegos.zeus.nexica.net (zeus)"; content:"|0a|minijuegos|04|zeus|06|nexica|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missing-codecs.com (malicious)"; content:"|0e|missing-codecs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup missing-codecs.org (malicious)"; content:"|0e|missing-codecs|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup momok.org (malicious)"; content:"|05|momok|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mudeungsan.org (malicious)"; content:"|0a|mudeungsan|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup music-nah.de (malicious)"; content:"|09|music-nah|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymediacenter.in (backdoor)"; content:"|0d|mymediacenter|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mywebsource.ru (malicious)"; content:"|0b|mywebsource|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup new-tube-fest.com (malicious)"; content:"|0d|new-tube-fest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ninaa1.com (malicious)"; content:"|06|ninaa1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omgomg9.co.cc (rogue)"; content:"|07|omgomg9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup os-savasumanovic.edu.rs (malicious)"; content:"|10|os-savasumanovic|03|edu|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup peosoe.com (spyeye)"; content:"|06|peosoe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup perejopa.com (malicious)"; content:"|08|perejopa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pgpg.ws (malicious)"; content:"|04|pgpg|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup photo-room.co.cc (iframe)"; content:"|0a|photo-room|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phuket-apartmentrentals.com (zeus)"; content:"|17|phuket-apartmentrentals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pivfeels.com (rogue)"; content:"|08|pivfeels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup playatord.com (zeus)"; content:"|09|playatord|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637095; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primenewmedia.com (trojan)"; content:"|0d|primenewmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637096; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptichkaleti88.com (zeus)"; content:"|0d|ptichkaleti88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637097; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ptyre.com (malicious)"; content:"|05|ptyre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637098; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q1w.ru (malware)"; content:"|03|q1w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637099; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup q3s.ru (malware)"; content:"|03|q3s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637100; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup randycolle.nl (zeus)"; content:"|0a|randycolle|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637101; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regflinbullst.net (malicious)"; content:"|0d|regflinbullst|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637102; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup registryfox.com (malicious)"; content:"|0b|registryfox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637103; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relaxsearch.uphero.com (exploit)"; content:"|0b|relaxsearch|06|uphero|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637104; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup relsd.in (exploit)"; content:"|05|relsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637105; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retnv.in (exploit)"; content:"|05|retnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637106; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rheal.biz (neosploit)"; content:"|05|rheal|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637107; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup richav2.co.cc (rogue)"; content:"|07|richav2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637108; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rks1.de (gumblar)"; content:"|04|rks1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637109; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup russianmomds.ru (rogue)"; content:"|0c|russianmomds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637110; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryuk2.co.cc (malicious)"; content:"|05|ryuk2|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637111; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ryuk6.co.cc (rogue)"; content:"|05|ryuk6|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637112; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safecreation58.co.cc (malicious)"; content:"|0e|safecreation58|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637113; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saldiri.org (malicious)"; content:"|07|saldiri|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637114; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sbpozoriste.org (malicious)"; content:"|0b|sbpozoriste|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637115; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup selcuks.net (malicious)"; content:"|07|selcuks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637116; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sendyourtraffic41.org (rogue)"; content:"|11|sendyourtraffic41|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637117; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servat-cooper.com (exploit)"; content:"|0d|servat-cooper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637118; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sex-suki.ru (malware)"; content:"|08|sex-suki|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637119; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexkoj.info (trojan)"; content:"|06|sexkoj|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637120; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shkafu.net (malicious)"; content:"|06|shkafu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637121; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup silajopa.com (malicious)"; content:"|08|silajopa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637122; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup simmentog.com (malicious)"; content:"|09|simmentog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637123; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smmagdet.in (exploit)"; content:"|08|smmagdet|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637124; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup snasidsopa.com (malicious)"; content:"|0a|snasidsopa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637125; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sparkleroads.com (zeus)"; content:"|0c|sparkleroads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637126; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup superupdates.com (trojan)"; content:"|0c|superupdates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637127; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suprasystem.tempsite.ws (malicious)"; content:"|0b|suprasystem|08|tempsite|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637128; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swsltd.biz (malicious)"; content:"|06|swsltd|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637129; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t-softindia.com (zeus)"; content:"|0b|t-softindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637130; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup talents-dz.com (zeus)"; content:"|0a|talents-dz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637131; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teamremovals.com (malicious)"; content:"|0c|teamremovals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637132; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup technologyenhancedlearning.net (malicious)"; content:"|1a|technologyenhancedlearning|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637133; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thebluffycrob.info (exploit)"; content:"|0d|thebluffycrob|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637134; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themasterscourtestate.com (gumblar)"; content:"|15|themasterscourtestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637135; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup themiline.in (neosploit)"; content:"|09|themiline|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637136; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tigerm.ru (malicious)"; content:"|06|tigerm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637137; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tjdhosp.co.kr (phishing)"; content:"|07|tjdhosp|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637138; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-source.org (exploit)"; content:"|0e|traffic-source|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637139; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u6l.ru (harmful)"; content:"|03|u6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637140; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup u7p.ru (harmful)"; content:"|03|u7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637141; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-java.com (zeus)"; content:"|0b|update-java|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637142; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updateflash.co.cc (malicious)"; content:"|0b|updateflash|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637143; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup urodinam.net (koobface_botnet)"; content:"|08|urodinam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637144; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usesecuritya.com (threat)"; content:"|0c|usesecuritya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637145; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup v00d00.org (malware)"; content:"|06|v00d00|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637146; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaseajretikru.com (malicious)"; content:"|0d|vaseajretikru|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637147; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaserys.ru (malicious)"; content:"|07|vaserys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637148; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vefase.info (threat)"; content:"|06|vefase|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637149; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vertucom62.me (malicious)"; content:"|0a|vertucom62|02|me"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637150; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup winter-smile.com (malware)"; content:"|0c|winter-smile|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637151; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wizardserv.biz.ua (exploit)"; content:"|0a|wizardserv|03|biz|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637152; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xb6.ru (malware)"; content:"|03|xb6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637153; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xc8.ru (malware)"; content:"|03|xc8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637154; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xkomanda.co.cc (exploit)"; content:"|08|xkomanda|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637155; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yb-sport-555.cn (malware)"; content:"|0c|yb-sport-555|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637156; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourlotcar.cn (malware)"; content:"|0a|yourlotcar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637157; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup youwillfindtheresomethinginterestinf.com (zeus)"; content:"|24|youwillfindtheresomethinginterestinf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637158; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup z140877.infobox.ru (zeus)"; content:"|07|z140877|07|infobox|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637159; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0checkingyourtraffic.com (koobface)"; content:"|14|0checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637160; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 10checkingyourtraffic.com (koobface)"; content:"|15|10checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637161; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 20checkingyourtraffic.com (koobface)"; content:"|15|20checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637162; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 20iamback.com (malware)"; content:"|09|20iamback|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637163; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 30checkingyourtraffic.com (koobface)"; content:"|15|30checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637164; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 40checkingyourtraffic.com (koobface)"; content:"|15|40checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637165; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4info-tools.com (malware)"; content:"|0b|4info-tools|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637166; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 60checkingyourtraffic.com (koobface)"; content:"|15|60checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637167; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 70checkingyourtraffic.com (koobface)"; content:"|15|70checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637168; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 80checkingyourtraffic.com (koobface)"; content:"|15|80checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637169; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 90checkingyourtraffic.com (koobface)"; content:"|15|90checkingyourtraffic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637170; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aliss.al.funpic.org (malware)"; content:"|05|aliss|02|al|06|funpic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637171; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup amriflooring.com (malware)"; content:"|0c|amriflooring|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637172; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup analys.ru (harmful)"; content:"|06|analys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637173; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup angelas.in (malware)"; content:"|07|angelas|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637174; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ankaragunesnakliyat.com (harmful)"; content:"|13|ankaragunesnakliyat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637175; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anujinfo.com (harmful)"; content:"|08|anujinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637176; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brusd.in (threat)"; content:"|05|brusd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637177; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cams2010.unlugar.com (malware)"; content:"|08|cams2010|07|unlugar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637178; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clientconfig.passport.net (malware)"; content:"|0c|clientconfig|08|passport|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637179; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dong69.co.kr (malware)"; content:"|06|dong69|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637180; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup euracom.de (malware)"; content:"|07|euracom|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637181; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastradotop.com (malware)"; content:"|0b|fastradotop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637182; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flvdirect.com (malware)"; content:"|09|flvdirect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637183; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-best-movies.com (malware)"; content:"|10|free-best-movies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637184; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gokartsvordirekt.info (harmful)"; content:"|10|gokartsvordirekt|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637185; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gpgp.ws (malware)"; content:"|04|gpgp|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637186; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsv1.de (malware)"; content:"|04|gsv1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637187; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hiphop.web.id (malware)"; content:"|06|hiphop|03|web|02|id"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637188; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kungfu.co.il (malware)"; content:"|06|kungfu|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637189; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lokexawan.cn (threat)"; content:"|09|lokexawan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637190; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masconazo.com (malware)"; content:"|09|masconazo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637191; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mbu.ac.th (malware)"; content:"|03|mbu|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637192; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mn2x.com (malware)"; content:"|04|mn2x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637193; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musitalentos.com (malware)"; content:"|0c|musitalentos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637194; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naty.org (harmful)"; content:"|04|naty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637195; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup noplumber.com (harmful)"; content:"|09|noplumber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637196; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup novostar.com (malware)"; content:"|08|novostar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637197; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nuklearartist.de (malware)"; content:"|0d|nuklearartist|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637198; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvild.in (threat)"; content:"|05|nvild|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637199; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pds18.egloos.com (malware)"; content:"|05|pds18|06|egloos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637200; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup polotele.fileave.com (malware)"; content:"|08|polotele|07|fileave|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637201; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prehastven.in (harmful)"; content:"|0a|prehastven|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637202; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scrapper-site.net (malware)"; content:"|0d|scrapper-site|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637203; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ses99s.cn (malware)"; content:"|06|ses99s|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637204; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sitasa.com (malware)"; content:"|06|sitasa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637205; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smarttrain.edu.vn (malware)"; content:"|0a|smarttrain|03|edu|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637206; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup so2alak.com (malware)"; content:"|07|so2alak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637207; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sub.downs.co.kr (malware)"; content:"|03|sub|05|downs|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637208; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suelenmodas.web47.f1.k8.com.br (malware)"; content:"|0b|suelenmodas|05|web47|02|f1|02|k8|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637209; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tc2000.com.ar (malware)"; content:"|06|tc2000|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637210; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetriumphantministry.com (malware)"; content:"|15|thetriumphantministry|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637211; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttqipai.com (malware)"; content:"|07|ttqipai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637212; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup usa-horse-club.org (malware)"; content:"|0e|usa-horse-club|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637213; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-codec.co.tv (fake_codec)"; content:"|0b|video-codec|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637214; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video1you.in (threat)"; content:"|09|video1you|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637215; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup volnv.in (threat)"; content:"|05|volnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637216; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vot-takie-pirogi.in (malware)"; content:"|10|vot-takie-pirogi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637217; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourgooglesuperanalytics.co.cc (malware)"; content:"|18|yourgooglesuperanalytics|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637218; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zhajinhua.cc (malware)"; content:"|09|zhajinhua|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637219; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup abrie.in (koobface)"; content:"|05|abrie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637220; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup agros.in (koobface)"; content:"|05|agros|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637221; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alldh.in (koobface)"; content:"|05|alldh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637222; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allxt.com (malware)"; content:"|05|allxt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637223; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup alodh.in (koobface)"; content:"|05|alodh|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637224; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anrio.in (koobface)"; content:"|05|anrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637225; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antsd.in (koobface)"; content:"|05|antsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637226; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aoxtv.in (koobface)"; content:"|05|aoxtv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637227; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appsd.in (koobface)"; content:"|05|appsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637228; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquui.in (koobface)"; content:"|05|aquui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637229; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arrie.in (koobface)"; content:"|05|arrie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637230; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup balsd.in (koobface)"; content:"|05|balsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637231; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barui.in (koobface)"; content:"|05|barui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637232; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bikey.in (koobface)"; content:"|05|bikey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637233; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bizenable.com (rogue)"; content:"|09|bizenable|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637234; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bkpuo.in (koobface)"; content:"|05|bkpuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637235; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bleui.in (koobface)"; content:"|05|bleui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637236; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brayx.in (koobface)"; content:"|05|brayx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637237; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broyx.in (koobface)"; content:"|05|broyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637238; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bryhw.in (koobface)"; content:"|05|bryhw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637239; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butui.in (koobface)"; content:"|05|butui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637240; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butuo.in (koobface)"; content:"|05|butuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637241; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup butyx.in (koobface)"; content:"|05|butyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637242; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cated.in (koobface)"; content:"|05|cated|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637243; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cedhw.in (koobface)"; content:"|05|cedhw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637244; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrie.in (koobface)"; content:"|05|chrie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637245; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrio.in (koobface)"; content:"|05|chrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637246; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cirui.in (koobface)"; content:"|05|cirui|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637247; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clrio.in (koobface)"; content:"|05|clrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637248; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cogoo.in (koobface)"; content:"|05|cogoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637249; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conuo.in (koobface)"; content:"|05|conuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637250; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conyx.in (koobface)"; content:"|05|conyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637251; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coparli.com (worm)"; content:"|07|coparli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637252; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup corie.in (koobface)"; content:"|05|corie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637253; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curie.in (koobface)"; content:"|05|curie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637254; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cusnv.in (koobface)"; content:"|05|cusnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637255; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup czkey.in (koobface)"; content:"|05|czkey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637256; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup degoo.in (koobface)"; content:"|05|degoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637257; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dennv.in (koobface)"; content:"|05|dennv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637258; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dugoo.in (koobface)"; content:"|05|dugoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637259; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dyayxsgsv.net (malware)"; content:"|09|dyayxsgsv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637260; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eagoo.in (koobface)"; content:"|05|eagoo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637261; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eboyx.in (koobface)"; content:"|05|eboyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637262; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecrio.in (koobface)"; content:"|05|ecrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637263; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ectuo.in (koobface)"; content:"|05|ectuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637264; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edbal.in (koobface)"; content:"|05|edbal|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637265; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edban.in (koobface)"; content:"|05|edban|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637266; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ederc.in (koobface)"; content:"|05|ederc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637267; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ederm.in (koobface)"; content:"|05|ederm|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637268; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edger.in (koobface)"; content:"|05|edger|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637269; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edimp.in (koobface)"; content:"|05|edimp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637270; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup edois.in (koobface)"; content:"|05|edois|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637271; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elrio.in (koobface)"; content:"|05|elrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637272; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enguo.in (koobface)"; content:"|05|enguo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637273; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eprio.in (koobface)"; content:"|05|eprio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637274; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eqrio.in (koobface)"; content:"|05|eqrio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637275; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fakey.in (koobface)"; content:"|05|fakey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637276; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscanner-online.org (koobface)"; content:"|12|fastscanner-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637277; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fastscannerr-online.org (koobface)"; content:"|13|fastscannerr-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637278; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fibnv.in (koobface)"; content:"|05|fibnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637279; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foryx.in (koobface)"; content:"|05|foryx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637280; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup franv.in (koobface)"; content:"|05|franv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637281; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fraos.in (koobface)"; content:"|05|fraos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637282; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup garie.in (koobface)"; content:"|05|garie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637283; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glouo.in (koobface)"; content:"|05|glouo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637284; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guinv.in (koobface)"; content:"|05|guinv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637285; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gutyeaz.com (malware)"; content:"|07|gutyeaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637286; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habsd.in (koobface)"; content:"|05|habsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637287; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hecuo.in (koobface)"; content:"|05|hecuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637288; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hekey.in (koobface)"; content:"|05|hekey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637289; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hitinto.com (malware)"; content:"|07|hitinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637290; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup humos.in (koobface)"; content:"|05|humos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637291; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hygos.in (koobface)"; content:"|05|hygos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637292; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hyrie.in (koobface)"; content:"|05|hyrie|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637293; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ilio01ili1.comappsd.in (koobface)"; content:"|0a|ilio01ili1|08|comappsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637294; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imbos.in (koobface)"; content:"|05|imbos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637295; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ionnv.in (koobface)"; content:"|05|ionnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637296; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamsd.in (koobface)"; content:"|05|jamsd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637297; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ktkelzrwqgq.com (malware)"; content:"|0b|ktkelzrwqgq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637298; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kykey.in (koobface)"; content:"|05|kykey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637299; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup latuo.in (koobface)"; content:"|05|latuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637300; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leunv.in (koobface)"; content:"|05|leunv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637301; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup linuo.in (koobface)"; content:"|05|linuo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637302; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup liuyx.in (koobface)"; content:"|05|liuyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637303; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup makey.in (koobface)"; content:"|05|makey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637304; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moosd.in (koobface)"; content:"|05|moosd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637305; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-antivirsplus.org (koobface)"; content:"|0f|my-antivirsplus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637306; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-antivirus-plus.org (koobface)"; content:"|11|my-antivirus-plus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637307; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-protect-online.org (koobface)"; content:"|11|my-protect-online|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637308; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-protectonline.org (koobface)"; content:"|10|my-protectonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637309; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup myantivirsplus.org (koobface)"; content:"|0e|myantivirsplus|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637310; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nvenc.in (koobface)"; content:"|05|nvenc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637311; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oscog.in (koobface)"; content:"|05|oscog|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637312; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osenc.in (koobface)"; content:"|05|osenc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637313; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oserr.in (koobface)"; content:"|05|oserr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637314; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup osmac.in (koobface)"; content:"|05|osmac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637315; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ospor.in (koobface)"; content:"|05|ospor|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637316; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ossce.in (koobface)"; content:"|05|ossce|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637317; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ossio.in (koobface)"; content:"|05|ossio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637318; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostab.in (koobface)"; content:"|05|ostab|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637319; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostac.in (koobface)"; content:"|05|ostac|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637320; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostio.in (koobface)"; content:"|05|ostio|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637321; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ostom.in (koobface)"; content:"|05|ostom|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637322; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ouned.in (koobface)"; content:"|05|ouned|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637323; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pantscow.ru (malware)"; content:"|08|pantscow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637324; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup purnv.in (koobface)"; content:"|05|purnv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637325; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pxdmx.in (koobface)"; content:"|05|pxdmx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637326; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ragew.in (koobface)"; content:"|05|ragew|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637327; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rekey.in (koobface)"; content:"|05|rekey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637328; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rooty.crabdance.com (rogue)"; content:"|05|rooty|09|crabdance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637329; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup s3xme1fucan.com (virus)"; content:"|0b|s3xme1fucan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637330; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup saled.in (koobface)"; content:"|05|saled|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637331; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sandra.prichaonica.com (malware)"; content:"|06|sandra|0b|prichaonica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637332; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sated.in (koobface)"; content:"|05|sated|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637333; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scoos.in (koobface)"; content:"|05|scoos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637334; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdali.in (koobface)"; content:"|05|sdali|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637335; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdall.in (koobface)"; content:"|05|sdall|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637336; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdayb.in (koobface)"; content:"|05|sdayb|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637337; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdaye.in (koobface)"; content:"|05|sdaye|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637338; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdayo.in (koobface)"; content:"|05|sdayo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637339; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdene.in (koobface)"; content:"|05|sdene|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637340; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdich.in (koobface)"; content:"|05|sdich|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637341; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sdome.in (koobface)"; content:"|05|sdome|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637342; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seedw.in (koobface)"; content:"|05|seedw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637343; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smoed.in (koobface)"; content:"|05|smoed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637344; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soted.in (koobface)"; content:"|05|soted|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637345; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spios.in (koobface)"; content:"|05|spios|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637346; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spkey.in (koobface)"; content:"|05|spkey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637347; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stteop.in (koobface)"; content:"|06|stteop|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637348; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sunyx.in (koobface)"; content:"|05|sunyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637349; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sydos.in (koobface)"; content:"|05|sydos|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637350; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup syekzwbaktwp.dyndns.org (malware)"; content:"|0c|syekzwbaktwp|06|dyndns|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637351; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sys-protectonline.org (koobface)"; content:"|11|sys-protectonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637352; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sysprotectonline.org (koobface)"; content:"|10|sysprotectonline|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637353; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup teaed.in (koobface)"; content:"|05|teaed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637354; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thynv.in (koobface)"; content:"|05|thynv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637355; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ugiyx.in (koobface)"; content:"|05|ugiyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637356; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uinei.in (koobface)"; content:"|05|uinei|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637357; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uinge.in (koobface)"; content:"|05|uinge|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637358; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uiren.in (koobface)"; content:"|05|uiren|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637359; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uirin.in (koobface)"; content:"|05|uirin|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637360; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uisap.in (koobface)"; content:"|05|uisap|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637361; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uisee.in (koobface)"; content:"|05|uisee|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637362; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uisma.in (koobface)"; content:"|05|uisma|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637363; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uitem.in (koobface)"; content:"|05|uitem|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637364; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uithi.in (koobface)"; content:"|05|uithi|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637365; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uityp.in (koobface)"; content:"|05|uityp|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637366; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup uityr.in (koobface)"; content:"|05|uityr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637367; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup varyx.in (koobface)"; content:"|05|varyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637368; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup veged.in (koobface)"; content:"|05|veged|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637369; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vidscentral.net (malicious)"; content:"|0b|vidscentral|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637370; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wakey.in (koobface)"; content:"|05|wakey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637371; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup whasd.in (koobface)"; content:"|05|whasd|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637372; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wimed.in (koobface)"; content:"|05|wimed|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637373; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup woonv.in (koobface)"; content:"|05|woonv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637374; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yokey.in (koobface)"; content:"|05|yokey|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637375; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxial.in (koobface)"; content:"|05|yxial|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637376; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yxiam.in (koobface)"; content:"|05|yxiam|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637377; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9down.com (malware)"; content:"|05|9down|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637378; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sujetline.ru (malware)"; content:"|09|sujetline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637379; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adwareprofessional.com (malware)"; content:"|12|adwareprofessional|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637380; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup financialdeposit.com (fastflux)"; content:"|10|financialdeposit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637381; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google223.ru (exploit)"; content:"|09|google223|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637382; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mabtion.cn (fastflux)"; content:"|07|mabtion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637383; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wooobo.cn (fastflux)"; content:"|06|wooobo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637384; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ad159.com (malware)"; content:"|05|ad159|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637385; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispy-defender.com (rogue)"; content:"|10|antispy-defender|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637386; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antispywork.com (rogue)"; content:"|0b|antispywork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637387; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivir-product.com (rogue)"; content:"|0f|antivir-product|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637388; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirmore.com (rogue)"; content:"|0b|antivirmore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637389; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirprime.com (rogue)"; content:"|0c|antivirprime|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637390; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirstat.com (rogue)"; content:"|0b|antivirstat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637391; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup appstoredemon.com (malware)"; content:"|0d|appstoredemon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637392; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup av-look.com (rogue)"; content:"|07|av-look|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637393; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bequeathooh4.info (malware)"; content:"|0c|bequeathooh4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637394; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertlicy.com (threat)"; content:"|08|bertlicy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637395; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup booksmeslia.com (gumblar)"; content:"|0b|booksmeslia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637396; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bootch.in (malware)"; content:"|06|bootch|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637397; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup borsalita.ru (gumblar)"; content:"|09|borsalita|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637398; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup boxcar.com (gumblar)"; content:"|06|boxcar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637399; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bradinfo.org (malware)"; content:"|08|bradinfo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637400; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup brightspacedehradun.com (gumblar)"; content:"|13|brightspacedehradun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637401; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bronwynjamrok.com (malware)"; content:"|0d|bronwynjamrok|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637402; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bryllupsbyraaet.no (gumblar)"; content:"|0f|bryllupsbyraaet|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637403; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bsk-spedition.de (gumblar)"; content:"|0d|bsk-spedition|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637404; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buypartylights.com (gumblar)"; content:"|0e|buypartylights|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637405; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup buysellferrari.com (gumblar)"; content:"|0e|buysellferrari|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637406; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cadglobal.ca (gumblar)"; content:"|09|cadglobal|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637407; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup campus-europe.com (gumblar)"; content:"|0d|campus-europe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637408; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cawwe.com (malware)"; content:"|05|cawwe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637409; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chrysby.com (malware)"; content:"|07|chrysby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637410; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup classyartsworld.com (malware)"; content:"|0f|classyartsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637411; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cleanupyoursoft.com (scareware)"; content:"|0f|cleanupyoursoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637412; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cntvs.com (malicious)"; content:"|05|cntvs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637413; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup codeconline.com (threat)"; content:"|0b|codeconline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637414; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coe-inc.com (malware)"; content:"|07|coe-inc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637415; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conundrumwth.info (threat)"; content:"|0c|conundrumwth|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637416; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cruelstar.net (malware)"; content:"|09|cruelstar|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637417; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfhk.info (malware)"; content:"|04|dfhk|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637418; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitaldataplus.com (malware)"; content:"|0f|digitaldataplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637419; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalpackback.com (malware)"; content:"|0f|digitalpackback|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637420; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directstraight.com (malware)"; content:"|0e|directstraight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637421; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eaglediver.com (malware)"; content:"|0a|eaglediver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637422; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ehost-services138.com (malware)"; content:"|11|ehost-services138|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637423; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup electronicbankdata.com (malware)"; content:"|12|electronicbankdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637424; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fglq.info (malware)"; content:"|04|fglq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637425; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleryp1.co.kr (malware)"; content:"|09|galleryp1|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637426; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google-stats.ru (malware)"; content:"|0c|google-stats|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637427; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatladymovies.com (malware)"; content:"|0f|greatladymovies|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637428; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guest.worldviewproduction.com (malware)"; content:"|05|guest|13|worldviewproduction|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637429; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gysdk.com (malware)"; content:"|05|gysdk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637430; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup homovisualarts.com (harmful)"; content:"|0e|homovisualarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637431; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotdf.com (botnet)"; content:"|05|hotdf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637432; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup housebythecemeterythe.moviecoupons.com (harmful)"; content:"|15|housebythecemeterythe|0c|moviecoupons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637433; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup imagequest360.com (malware)"; content:"|0d|imagequest360|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637434; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup indiabackwaters.com (malware)"; content:"|0f|indiabackwaters|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637435; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup inputen.com (malware)"; content:"|07|inputen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637436; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kingfinearts.com (botnet)"; content:"|0c|kingfinearts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637437; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kollo.ch (malware)"; content:"|05|kollo|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637438; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup man-tekconsultinginc.biz (malware)"; content:"|14|man-tekconsultinginc|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637439; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maremot.com (threat)"; content:"|07|maremot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637440; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mfjr.info (threat)"; content:"|04|mfjr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637441; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup middlelist.com (malware)"; content:"|0a|middlelist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637442; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moretoparts.com (rogue)"; content:"|0b|moretoparts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637443; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup moviemoto.org (malware)"; content:"|09|moviemoto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637444; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mygoodguardian.com (scareware)"; content:"|0e|mygoodguardian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637445; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymasters.in (malware)"; content:"|09|mymasters|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637446; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mytrueguardian.net (scareware)"; content:"|0e|mytrueguardian|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637447; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlyscan.tk (malware)"; content:"|08|onlyscan|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637448; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phenomenon789v.info (malware)"; content:"|0e|phenomenon789v|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637449; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pitchblackaudio.pamhuth.com (malware)"; content:"|0f|pitchblackaudio|07|pamhuth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637450; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup railuhocal.ru (malware)"; content:"|0a|railuhocal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637451; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup samsgreatarts.com (malware)"; content:"|0d|samsgreatarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637452; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scripts.cgispy.com (malware)"; content:"|07|scripts|06|cgispy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637453; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexkoq.info (malware)"; content:"|06|sexkoq|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637454; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sh-yz.biz (malware)"; content:"|05|sh-yz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637455; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smartavz.com (scareware)"; content:"|08|smartavz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637456; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-cleaner.com (scareware)"; content:"|0c|soft-cleaner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637457; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft-cleaner.net (scareware)"; content:"|0c|soft-cleaner|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637458; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ssl-pool.in (malware)"; content:"|08|ssl-pool|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637459; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup theelectricarts.com (malware)"; content:"|0f|theelectricarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637460; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ushship.com (malware)"; content:"|07|ushship|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637461; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-files.org (harmful)"; content:"|0b|video-files|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637462; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-library.org (harmful)"; content:"|0d|video-library|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637463; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup video-sharing.org (harmful)"; content:"|0d|video-sharing|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637464; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vxplanet.net (malware)"; content:"|08|vxplanet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637465; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup warezforyou24.co.cc (scareware)"; content:"|0d|warezforyou24|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637466; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup werh.biz (malware)"; content:"|04|werh|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637467; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xpresdnet.com (malware)"; content:"|09|xpresdnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637468; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 0815.ch (malware)"; content:"|04|0815|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637469; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3408530458043rotabannergoogle.com (exploit)"; content:"|1d|3408530458043rotabannergoogle|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637470; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3gcompanyplc.com (malware)"; content:"|0c|3gcompanyplc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637471; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 885poiker.info (malware)"; content:"|09|885poiker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637472; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aaqx.ru (zeus)"; content:"|04|aaqx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637473; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adservercentral.info (malware)"; content:"|0f|adservercentral|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637474; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup allxscan.tk (exploit)"; content:"|08|allxscan|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637475; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antivirusavgversionefree.com (harmful)"; content:"|18|antivirusavgversionefree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637476; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aqqx.ru (zeus)"; content:"|04|aqqx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637477; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup aquafino.com (zeus)"; content:"|08|aquafino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637478; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup atx7.biz (zeus)"; content:"|04|atx7|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637479; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup awmobilemechanic.co.uk (malware)"; content:"|10|awmobilemechanic|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637480; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barabudd333.com (trojan)"; content:"|0b|barabudd333|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637481; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bb-phones.ru (malware)"; content:"|09|bb-phones|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637482; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup beinfo.in (malicious)"; content:"|06|beinfo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637483; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bellicosek8.info (threat)"; content:"|0b|bellicosek8|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637484; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bemoanlyy.info (malware)"; content:"|09|bemoanlyy|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637485; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup best-tube-time.com (malicious)"; content:"|0e|best-tube-time|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637486; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bestcasinozweb.ru (malicious)"; content:"|0e|bestcasinozweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637487; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup browserstat.in (malicious)"; content:"|0b|browserstat|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637488; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carapuce.eu (gumblar)"; content:"|08|carapuce|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637489; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cardo.dk (zeus)"; content:"|05|cardo|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637490; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carlossalina.com.ar (blog.unmaskparasites.com)"; content:"|0c|carlossalina|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637491; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casio-hodinky.com (blog.unmaskparasites.com)"; content:"|0d|casio-hodinky|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637492; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup centralinmobiliaria.com.ar (malicious)"; content:"|13|centralinmobiliaria|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637493; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceters.biz (malware)"; content:"|06|ceters|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637494; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup choww.in (malware)"; content:"|05|choww|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637495; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup clickjujuy.com.ar (malicious)"; content:"|0a|clickjujuy|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637496; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coolutils.com (malware)"; content:"|09|coolutils|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637497; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup core3023.programmingshool.com (trojan)"; content:"|08|core3023|10|programmingshool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637498; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup curseri.ch (malware)"; content:"|07|curseri|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637499; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup defenderprotection.in (malicious)"; content:"|12|defenderprotection|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637500; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dehtrader.com (zeus)"; content:"|09|dehtrader|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637501; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deltalloydbusinesscourse.nl (zeus)"; content:"|18|deltalloydbusinesscourse|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637502; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dentalnursenetwork.com (malware)"; content:"|12|dentalnursenetwork|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637503; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designtrl.km.ua (malware)"; content:"|09|designtrl|02|km|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637504; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dfrscanner.tk (malicious)"; content:"|0a|dfrscanner|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637505; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dnsdnsprovider.com (c&c)"; content:"|0e|dnsdnsprovider|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637506; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e2dx.com (malware)"; content:"|04|e2dx|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637507; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup e6532.com (malware)"; content:"|05|e6532|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637508; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ecuadorsito.com (malicious)"; content:"|0b|ecuadorsito|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637509; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elt-time.com (malicious)"; content:"|08|elt-time|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637510; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup everytds.tk (exploit)"; content:"|08|everytds|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637511; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup evishop.de (exploit)"; content:"|07|evishop|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637512; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezonemall.com (zeus)"; content:"|09|ezonemall|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637513; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fasttopesearch.com (malware)"; content:"|0e|fasttopesearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637514; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feelfree31.co.cc (malicious)"; content:"|0a|feelfree31|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637515; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup firat33.fi.funpic.org (trojan)"; content:"|07|firat33|02|fi|06|funpic|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637516; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fist0.info (trojan)"; content:"|05|fist0|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637517; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flybod.com (malicious)"; content:"|06|flybod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637518; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folkebladet.dk (zeus)"; content:"|0b|folkebladet|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637519; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup foodmp.com (malware)"; content:"|06|foodmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637520; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fuzzyyellowballs.com (malware)"; content:"|10|fuzzyyellowballs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637521; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fvds.ru (trojan)"; content:"|04|fvds|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637522; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galaxymusicarts.com (artro)"; content:"|0f|galaxymusicarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637523; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gassra.com (bot)"; content:"|06|gassra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637524; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ggdesk.com (malicious)"; content:"|06|ggdesk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637525; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup glassbest.com (zeus)"; content:"|09|glassbest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637526; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlemugl.com (trojan)"; content:"|0a|googlemugl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637527; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatnaturearts.com (artro)"; content:"|0f|greatnaturearts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637528; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtrb.ru (zeus)"; content:"|04|gtrb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637529; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gtrfz.biz (malware)"; content:"|05|gtrfz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637530; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup handbag001.com (malicious)"; content:"|0a|handbag001|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637531; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hanhaho.com (malicious)"; content:"|07|hanhaho|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637532; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hedere.info (neosploit)"; content:"|06|hedere|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637533; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hescius.com (zeus)"; content:"|07|hescius|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637534; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotproud.com (malicious)"; content:"|08|hotproud|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637535; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup houseofafricaguesthouse.co.za (zeus)"; content:"|17|houseofafricaguesthouse|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637536; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup igoodmedia.com (trojan)"; content:"|0a|igoodmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637537; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iimba.org.il (zeus)"; content:"|05|iimba|03|org|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637538; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup info-news.name (zeus)"; content:"|09|info-news|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637539; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup intrepidintl.com (malware)"; content:"|0c|intrepidintl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637540; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itg.nrct.go.th (malicious)"; content:"|03|itg|04|nrct|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637541; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaftest.com (zeus)"; content:"|07|jaftest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637542; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jamyx.in (malware)"; content:"|05|jamyx|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637543; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kodebazaar.com (zeus)"; content:"|0a|kodebazaar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637544; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koska.sytes.net (malware)"; content:"|05|koska|05|sytes|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637545; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup littleartsworld.com (artro)"; content:"|0f|littleartsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637546; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loading.own.cz (malware)"; content:"|07|loading|03|own|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637547; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup login.live.com.nci.uni.cc (malicious)"; content:"|05|login|04|live|03|com|03|nci|03|uni|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637548; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lzqxszbdmms.com (neosploit)"; content:"|0b|lzqxszbdmms|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637549; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magmaessex.co.uk (zeus)"; content:"|0a|magmaessex|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637550; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup main01.isa-geek.com (malware)"; content:"|06|main01|08|isa-geek|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637551; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup malecafe.net (malicious)"; content:"|08|malecafe|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637552; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mamasun.org (zeus)"; content:"|07|mamasun|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637553; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mejac.com (malicious)"; content:"|05|mejac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637554; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mgxkqsulhkzl.com (neosploit)"; content:"|0c|mgxkqsulhkzl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637555; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ml512.com (malware)"; content:"|05|ml512|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637556; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newch4u.co.kr (malware)"; content:"|07|newch4u|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637557; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup newconcurso.info (malware)"; content:"|0b|newconcurso|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637558; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup neweraarts.com (malware)"; content:"|0a|neweraarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637559; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nike1ot2n.com (fakeav)"; content:"|09|nike1ot2n|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637560; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nnam.ru (zeus)"; content:"|04|nnam|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637561; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nostalgiaefs3.info (malware)"; content:"|0d|nostalgiaefs3|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637562; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oemsoftbestseller-1.ru (malicious)"; content:"|13|oemsoftbestseller-1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637563; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup oodmp.com (malicious)"; content:"|05|oodmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637564; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pifa.se (zeus)"; content:"|04|pifa|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637565; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup qcma.co.uk (malware)"; content:"|04|qcma|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637566; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realpayplus.com (fraud)"; content:"|0b|realpayplus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637567; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup realprotection32.co.cc (malicious)"; content:"|10|realprotection32|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637568; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup recuperatekj4.info (malware)"; content:"|0d|recuperatekj4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637569; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rotabannerutroru234x100x100.com (exploit)"; content:"|1b|rotabannerutroru234x100x100|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637570; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup runtarius.cc (zeus)"; content:"|09|runtarius|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637571; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sa-ppas12.com (malware)"; content:"|09|sa-ppas12|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637572; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup safe-web.name (zeus)"; content:"|08|safe-web|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637573; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup salx.cc (zeus)"; content:"|04|salx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637574; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secondnaturearts.com (artro)"; content:"|10|secondnaturearts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637575; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup seelenbuecher.de (zeus)"; content:"|0d|seelenbuecher|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637576; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sernv.in (exploit)"; content:"|05|sernv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637577; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sj82hags6.com (zeus)"; content:"|09|sj82hags6|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637578; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slcore.in (malicious)"; content:"|06|slcore|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637579; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup socratessavvides.com (malicious)"; content:"|10|socratessavvides|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637580; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup solenet.net (malicious)"; content:"|07|solenet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637581; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup statistics-of-world.org (zeus)"; content:"|13|statistics-of-world|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637582; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stream-online.info (malicious)"; content:"|0d|stream-online|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637583; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup susiehays.com (malicious)"; content:"|09|susiehays|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637584; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup swatchclock.in (malicious)"; content:"|0b|swatchclock|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637585; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sxm22.com (malicious)"; content:"|05|sxm22|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637586; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topbeinahe.com (rogue)"; content:"|0a|topbeinahe|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637587; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup topicnine.net (artro)"; content:"|09|topicnine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637588; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafcenter.us (malicious)"; content:"|0a|trafcenter|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637589; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traffic-increases.com (malware)"; content:"|11|traffic-increases|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637590; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup traficsource.org (malware)"; content:"|0c|traficsource|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637591; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup truestarmedia.com (trojan)"; content:"|0d|truestarmedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637592; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ttdang.com (malware)"; content:"|06|ttdang|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637593; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubedirect.net (malicious)"; content:"|0a|tubedirect|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637594; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tubezz.org (malicious)"; content:"|06|tubezz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637595; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup unbreakabletattoo.com (zeus)"; content:"|11|unbreakabletattoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637596; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup update-center.net (malicious)"; content:"|0d|update-center|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637597; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup valmarko.lv (malicious)"; content:"|08|valmarko|02|lv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637598; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vaxasa.info (neosploit)"; content:"|06|vaxasa|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637599; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vendicious.com (zeus)"; content:"|0a|vendicious|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637600; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup videozone.yc.cz (trojan)"; content:"|09|videozone|02|yc|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637601; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup visvrienden.nl (zeus)"; content:"|0b|visvrienden|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637602; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vk-socks.net (trojan)"; content:"|08|vk-socks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637603; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vkontakte-theme.ru (zeus)"; content:"|0f|vkontakte-theme|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637604; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup votrepharma.com (malicious)"; content:"|0b|votrepharma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637605; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wangqiao365.com (malware)"; content:"|0b|wangqiao365|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637606; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wardefer.com (malware)"; content:"|08|wardefer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637607; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbonus-gamez.ru (malicious)"; content:"|0e|webbonus-gamez|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637608; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webbrainworks.com (artro)"; content:"|0d|webbrainworks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637609; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wgetsoft.net (malware)"; content:"|08|wgetsoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637610; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wmblive.com (malicious)"; content:"|07|wmblive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637611; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xinjiapo123.cn (trojan)"; content:"|0b|xinjiapo123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637612; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yadr1.com (trojan)"; content:"|05|yadr1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637613; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yadr2.com (malware)"; content:"|05|yadr2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637614; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yellow-cargo.com (zeus)"; content:"|0c|yellow-cargo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637615; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup yourprotection88.co.cc (malicious)"; content:"|10|yourprotection88|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637616; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zateba.info (exploit)"; content:"|06|zateba|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637617; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zephehooqu.ru (zeus)"; content:"|0a|zephehooqu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637618; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zicateam.info (trojan)"; content:"|08|zicateam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637619; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zybr.in (malicious)"; content:"|04|zybr|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637620; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a1e1.net (harmful)"; content:"|04|a1e1|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637621; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup almahdi.webphoto.ir (harmful)"; content:"|07|almahdi|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637622; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anishinfoways.us (harmful)"; content:"|0d|anishinfoways|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637623; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup anupamhoteliersltd.com (harmful)"; content:"|12|anupamhoteliersltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637624; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b2bdebtcollection.co.uk (zeus)"; content:"|11|b2bdebtcollection|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637625; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b2bdebtrecovery.co.uk (zeus)"; content:"|0f|b2bdebtrecovery|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637626; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup barakobrama.com (zeus)"; content:"|0b|barakobrama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637627; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bayareapeacekeepers.org (malicious)"; content:"|13|bayareapeacekeepers|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637628; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup betterlibrariesforpaloalto.com (harmful)"; content:"|1a|betterlibrariesforpaloalto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637629; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casino-you.com (malicious)"; content:"|0a|casino-you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637630; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinodeal.org (malicious)"; content:"|0a|casinodeal|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637631; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinozbestmy.ru (malicious)"; content:"|0d|casinozbestmy|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637632; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinozbestweb.ru (malicious)"; content:"|0e|casinozbestweb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637633; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinozmy-best.ru (malicious)"; content:"|0e|casinozmy-best|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637634; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup casinozmybest.ru (malicious)"; content:"|0d|casinozmybest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637635; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cbx-north.se (gumblar)"; content:"|09|cbx-north|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637636; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceferd.com (gumblar)"; content:"|06|ceferd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637637; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cestoweb.rajzdravi.cz (gumblar)"; content:"|08|cestoweb|09|rajzdravi|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637638; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceylon-tours.de (gumblar)"; content:"|0c|ceylon-tours|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637639; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup chatabebek.cz (gumblar)"; content:"|0a|chatabebek|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637640; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cheapphotography.org (gumblar)"; content:"|10|cheapphotography|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637641; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cinartekstil.net (gumblar)"; content:"|0c|cinartekstil|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637642; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cipayroll.com (gumblar)"; content:"|09|cipayroll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637643; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup claptones.hu (gumblar)"; content:"|09|claptones|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637644; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup coiffure-claude.com (gumblar)"; content:"|0f|coiffure-claude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637645; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cologne-mohair-dyers.com (gumblar)"; content:"|14|cologne-mohair-dyers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637646; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup communications.baydem.com (gumblar)"; content:"|0e|communications|06|baydem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637647; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup compfuture.net (gumblar)"; content:"|0a|compfuture|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637648; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup conta-vencedora.pt (gumblar)"; content:"|0f|conta-vencedora|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637649; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cosmoabc.com (gumblar)"; content:"|08|cosmoabc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637650; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup countryinsulation.co.uk (gumblar)"; content:"|11|countryinsulation|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637651; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crc.ac.th (gumblar)"; content:"|03|crc|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637652; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup crm4u.co.il (gumblar)"; content:"|05|crm4u|02|co|02|il"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637653; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cronbronzvon.net (malware)"; content:"|0c|cronbronzvon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637654; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup culturechine.org (gumblar)"; content:"|0c|culturechine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637655; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup daeneung.co.kr (harmful)"; content:"|08|daeneung|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637656; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dailylaiken.com (gumblar)"; content:"|0b|dailylaiken|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637657; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup damisystem.com (gumblar)"; content:"|0a|damisystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637658; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup danielfarina.com (malware)"; content:"|0c|danielfarina|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637659; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup day-sity.ho.ua (gumblar)"; content:"|08|day-sity|02|ho|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637660; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dayspaxalapa.com (gumblar)"; content:"|0c|dayspaxalapa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637661; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup demkarklima.com (gumblar)"; content:"|0b|demkarklima|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637662; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup denisen.com.cn (gumblar)"; content:"|07|denisen|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637663; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designetmoi.com (gumblar)"; content:"|0b|designetmoi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637664; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup designrj.com (gumblar)"; content:"|08|designrj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637665; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup deutscheshaus.ge (gumblar)"; content:"|0d|deutscheshaus|02|ge"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637666; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup devman.org (gumblar)"; content:"|06|devman|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637667; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dgiz.de (malicious)"; content:"|04|dgiz|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637668; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diedeutschmeisterin.at (zeus)"; content:"|13|diedeutschmeisterin|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637669; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup digitalmediaset.com (trojan)"; content:"|0f|digitalmediaset|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637670; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup directpharma.net (malicious)"; content:"|0c|directpharma|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637671; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup divineinnovation.net (gumblar)"; content:"|10|divineinnovation|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637672; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup djcyclesstore.com (gumblar)"; content:"|0d|djcyclesstore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637673; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dkbc.org (gumblar)"; content:"|04|dkbc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637674; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctor-jade.ru (gumblar)"; content:"|0b|doctor-jade|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637675; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup doctor-samru.57.com1.ru (gumblar)"; content:"|0c|doctor-samru|02|57|04|com1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637676; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolphinassociates.in (gumblar)"; content:"|11|dolphinassociates|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637677; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup download-reactor.com (gumblar)"; content:"|10|download-reactor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637678; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup downloadfreemcafeeantivirus.com (exploit)"; content:"|1b|downloadfreemcafeeantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637679; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup drakken.com.ar (gumblar)"; content:"|07|drakken|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637680; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsc.com.eg (harmful)"; content:"|03|dsc|03|com|02|eg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637681; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dsofttech.com (gumblar)"; content:"|09|dsofttech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637682; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dylanromer.com (gumblar)"; content:"|0a|dylanromer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637683; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ebi-live-chat.net (gumblar)"; content:"|0d|ebi-live-chat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637684; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elaheh.webphoto.ir (gumblar)"; content:"|06|elaheh|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637685; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elcombra.de (gumblar)"; content:"|08|elcombra|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637686; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup elizabethdschafer.com (gumblar)"; content:"|11|elizabethdschafer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637687; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emglabor.de (gumblar)"; content:"|08|emglabor|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637688; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup emuna.com.ua (gumblar)"; content:"|05|emuna|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637689; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup energyinfo.com.br (gumblar)"; content:"|0a|energyinfo|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637690; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enftv.org (gumblar)"; content:"|05|enftv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637691; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup eng.ru.ac.th (gumblar)"; content:"|03|eng|02|ru|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637692; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup engelbertink-hoveniersbedrijf.nl (gumblar)"; content:"|1d|engelbertink-hoveniersbedrijf|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637693; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup englishrescue.com (gumblar)"; content:"|0d|englishrescue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637694; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup enutritionhub.com (gumblar)"; content:"|0d|enutritionhub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637695; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup escorialescorial.com (gumblar)"; content:"|10|escorialescorial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637696; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup etqw.hu (gumblar)"; content:"|04|etqw|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637697; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exactwatches.com (malicious)"; content:"|0c|exactwatches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637698; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup exponentialreturns.com (gumblar)"; content:"|12|exponentialreturns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637699; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup expresshomecinema.com (gumblar)"; content:"|11|expresshomecinema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637700; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup extraflowtraff.in (malware)"; content:"|0e|extraflowtraff|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637701; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ezgmp.com (harmful)"; content:"|05|ezgmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637702; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fabil.pl (gumblar)"; content:"|05|fabil|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637703; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fagfolkfakta.no (gumblar)"; content:"|0c|fagfolkfakta|02|no"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637704; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fashiontouch.net (gumblar)"; content:"|0c|fashiontouch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637705; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fauxtastic.net (gumblar)"; content:"|0a|fauxtastic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637706; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup felipeycamila.com.ar (gumblar)"; content:"|0d|felipeycamila|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637707; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup feltonmachine.com (gumblar)"; content:"|0d|feltonmachine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637708; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferozkhan.in (gumblar)"; content:"|09|ferozkhan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637709; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ferrytopia.com (gumblar)"; content:"|0a|ferrytopia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637710; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup findsens.dk (gumblar)"; content:"|08|findsens|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637711; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeantivirus31.com (harmful)"; content:"|0f|freeantivirus31|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637712; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeartstv.com (artro)"; content:"|0a|freeartstv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637713; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freebasicantivirus.com (exploit)"; content:"|12|freebasicantivirus|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637714; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeboobsarts.com (artro)"; content:"|0d|freeboobsarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637715; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freehitdata.com (malware)"; content:"|0b|freehitdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637716; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freereview.in (malware)"; content:"|0a|freereview|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637717; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup freeserials.ws (malware)"; content:"|0b|freeserials|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637718; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gagainco.com (harmful)"; content:"|08|gagainco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637719; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gate4ads.info (zeus)"; content:"|08|gate4ads|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637720; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greenwatt.co.uk (harmful)"; content:"|09|greenwatt|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637721; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup guanabaratravel.com (harmful)"; content:"|0f|guanabaratravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637722; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itspitsp.com (zeus)"; content:"|08|itspitsp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637723; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jeffs-koreskole.dk (zeus)"; content:"|0f|jeffs-koreskole|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637724; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jocudaidie.ru (zeus)"; content:"|0a|jocudaidie|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637725; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joinnow20.co.cc (malicious)"; content:"|09|joinnow20|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637726; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jointo27.co.cc (malicious)"; content:"|08|jointo27|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637727; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jseuz.tk (malicious)"; content:"|05|jseuz|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637728; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jubilantetty6.info (trojan)"; content:"|0d|jubilantetty6|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637729; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knuenglish.co.kr (harmful)"; content:"|0a|knuenglish|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637730; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup knuenglish.mireene.com (harmful)"; content:"|0a|knuenglish|07|mireene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637731; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koreaexport.co.kr (harmful)"; content:"|0b|koreaexport|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637732; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lessown.in (malware)"; content:"|07|lessown|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637733; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lightpalace.net (zeus)"; content:"|0b|lightpalace|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637734; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup loloohuildifsd.ru (zeus)"; content:"|0e|loloohuildifsd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637735; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marketholiday.ru (malspam)"; content:"|0d|marketholiday|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637736; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediahopes.com (malware)"; content:"|0a|mediahopes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637737; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediaservicesdata.com (-)"; content:"|11|mediaservicesdata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637738; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mediavisualarts.com (artro)"; content:"|0f|mediavisualarts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637739; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mitroc.com (gumblar)"; content:"|06|mitroc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637740; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup montemeubles-location.com (zeus)"; content:"|15|montemeubles-location|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637741; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup montezuma.spb.ru (malware)"; content:"|09|montezuma|03|spb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637742; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup musiceng.ru (malware)"; content:"|08|musiceng|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637743; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my3gb.com (malicious)"; content:"|05|my3gb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637744; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup najahsalam.net (harmful)"; content:"|0a|najahsalam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637745; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naphi.com (malicious)"; content:"|05|naphi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637746; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup nikrogul.ovh.org (harmful)"; content:"|08|nikrogul|03|ovh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637747; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup obec.go.th (harmful)"; content:"|04|obec|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637748; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup okport.in (malicious)"; content:"|06|okport|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637749; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup onlink.in (exploit)"; content:"|06|onlink|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637750; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prodin.com.ar (harmful)"; content:"|06|prodin|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637751; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup replicabagcenter.com (malicious)"; content:"|10|replicabagcenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637752; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup replicahandbagscheap.com (malicious)"; content:"|14|replicahandbagscheap|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637753; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup replicahandbagsite.com (malicious)"; content:"|12|replicahandbagsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637754; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup retailsecurity21.com (harmful)"; content:"|10|retailsecurity21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637755; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ruskodom.ru (gumblar)"; content:"|08|ruskodom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637756; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rytectvo.host.sk (harmful)"; content:"|08|rytectvo|04|host|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637757; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdead.com (rogue)"; content:"|0a|searchdead|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637758; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchdear.com (trojan)"; content:"|0a|searchdear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637759; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup searchfunes.org (harmful)"; content:"|0b|searchfunes|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637760; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shirazittc.ir (harmful)"; content:"|0a|shirazittc|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637761; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sochi.nov.ru (harmful)"; content:"|05|sochi|03|nov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637762; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup taxshelf.ru (iframe)"; content:"|08|taxshelf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637763; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup wanderlusting.net (gumblar)"; content:"|0d|wanderlusting|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637764; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup web2host.in (harmful)"; content:"|08|web2host|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637765; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserivcekota.ru (sql_injection)"; content:"|0e|webserivcekota|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637766; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserivcessh.ru (sql_injection)"; content:"|0d|webserivcessh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637767; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserivcezub.ru (sql_injection)"; content:"|0d|webserivcezub|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637768; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserviceaan.ru (sql_injection)"; content:"|0d|webserviceaan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637769; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicebal.ru (sql_injection)"; content:"|0d|webservicebal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637770; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicedevlop.ru (sql_injection)"; content:"|10|webservicedevlop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637771; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserviceforward.ru (sql_injection)"; content:"|11|webserviceforward|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637772; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserviceftp.ru (sql_injection)"; content:"|0d|webserviceftp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637773; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicekuz.ru (sql_injection)"; content:"|0d|webservicekuz|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637774; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicelupa.ru (sql_injection)"; content:"|0e|webservicelupa|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637775; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicenow.ru (sql_injection)"; content:"|0d|webservicenow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637776; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicesbba.ru (sql_injection)"; content:"|0e|webservicesbba|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637777; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webserviceskot.ru (sql_injection)"; content:"|0e|webserviceskot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637778; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicesmulti.ru (sql_injection)"; content:"|10|webservicesmulti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637779; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicesrob.ru (sql_injection)"; content:"|0e|webservicesrob|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637780; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicessl.ru (sql_injection)"; content:"|0d|webservicessl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637781; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicesttt.ru (sql_injection)"; content:"|0e|webservicesttt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637782; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webservicezok.ru (sql_injection)"; content:"|0d|webservicezok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637783; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup webwinkel-klusje.nl (harmful)"; content:"|10|webwinkel-klusje|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637784; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1debtcreditcards.com (harmful)"; content:"|10|1debtcreditcards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637785; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 6r66.com (harmful)"; content:"|04|6r66|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637786; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 75a.net (harmful)"; content:"|03|75a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637787; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup activesecuritynet.org (malicious)"; content:"|11|activesecuritynet|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637788; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup antiviru.ru (harmful)"; content:"|08|antiviru|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637789; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup arena-eg.com (gumblar)"; content:"|08|arena-eg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637790; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup avtracker.info (malware)"; content:"|09|avtracker|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637791; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup azdanzyeemlak.biz (harmful)"; content:"|0d|azdanzyeemlak|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637792; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bali-yama.com (harmful)"; content:"|09|bali-yama|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637793; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup blackhollywoodhu.com (gumblar)"; content:"|10|blackhollywoodhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637794; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cit-lm.sk (harmful)"; content:"|06|cit-lm|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637795; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cjbux.com (harmful)"; content:"|05|cjbux|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637796; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dairanet.cn (zeus)"; content:"|08|dairanet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637797; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup earthi0-3d.com (malware)"; content:"|0a|earthi0-3d|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637798; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fitdurchphysio.de (gumblar)"; content:"|0e|fitdurchphysio|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637799; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup flashback.dp.ua (gumblar)"; content:"|09|flashback|02|dp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637800; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup floristeriatorrens.com (gumblar)"; content:"|12|floristeriatorrens|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637801; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup focusonesthetics.com (gumblar)"; content:"|10|focusonesthetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637802; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup folkartist-kr.com (gumblar)"; content:"|0d|folkartist-kr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637803; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fotoris.com (gumblar)"; content:"|07|fotoris|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637804; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup free-birthday-party.com (gumblar)"; content:"|13|free-birthday-party|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637805; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frenchpharmacyonline.com (gumblar)"; content:"|14|frenchpharmacyonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637806; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fromsuperb.com (fastflux)"; content:"|0a|fromsuperb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637807; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup frontflip.se (gumblar)"; content:"|09|frontflip|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637808; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup funkyclients.nl (gumblar)"; content:"|0c|funkyclients|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637809; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fzdqjn.cn (gumblar)"; content:"|06|fzdqjn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637810; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g12.ro (gumblar)"; content:"|03|g12|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637811; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup g3l.co.in (gumblar)"; content:"|03|g3l|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637812; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gadgetsshore.com (gumblar)"; content:"|0c|gadgetsshore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637813; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup galleparadise.com (gumblar)"; content:"|0d|galleparadise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637814; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gallery.soss.co.in (gumblar)"; content:"|07|gallery|04|soss|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637815; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gang.dothome.co.kr (gumblar)"; content:"|04|gang|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637816; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gclub1688.net (gumblar)"; content:"|09|gclub1688|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637817; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geco.zc.bz (harmful)"; content:"|04|geco|02|zc|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637818; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gemus.pl (gumblar)"; content:"|05|gemus|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637819; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gold-eshop.com (gumblar)"; content:"|0a|gold-eshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637820; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldenhospital.com (gumblar)"; content:"|0e|goldenhospital|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637821; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup golfpromadeeasy.com (gumblar)"; content:"|0f|golfpromadeeasy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637822; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodmann.net (gumblar)"; content:"|08|goodmann|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637823; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup googlevirustemizleme.com (gumblar)"; content:"|14|googlevirustemizleme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637824; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gorselankara.com (gumblar)"; content:"|0c|gorselankara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637825; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gozites.com (gumblar)"; content:"|07|gozites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637826; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gpdiebenhaezerposo.org (gumblar)"; content:"|12|gpdiebenhaezerposo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637827; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup grameendev.org (gumblar)"; content:"|0a|grameendev|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637828; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup granpiano.com.mx (gumblar)"; content:"|09|granpiano|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637829; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup graphicmanagementassociates.com (gumblar)"; content:"|1b|graphicmanagementassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637830; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gratisthumbs.com (gumblar)"; content:"|0c|gratisthumbs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637831; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatlakesicecream.com (gumblar)"; content:"|12|greatlakesicecream|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637832; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatrxdecide.com (fastflux)"; content:"|0d|greatrxdecide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637833; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gsccleveland.com (gumblar)"; content:"|0c|gsccleveland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637834; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup habbo-star.bplaced.net (gumblar)"; content:"|0a|habbo-star|07|bplaced|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637835; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup haggar.cl (gumblar)"; content:"|06|haggar|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637836; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup happy104.com (gumblar)"; content:"|08|happy104|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637837; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hazuse.com (gumblar)"; content:"|06|hazuse|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637838; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup healthplanone.net (gumblar)"; content:"|0d|healthplanone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637839; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hickorys.ca (gumblar)"; content:"|08|hickorys|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637840; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hindustanrealtyservices.com (gumblar)"; content:"|17|hindustanrealtyservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637841; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hoefra.at (gumblar)"; content:"|06|hoefra|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637842; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hopelife.in (gumblar)"; content:"|08|hopelife|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637843; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotelsathyam.co.in (gumblar)"; content:"|0c|hotelsathyam|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637844; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup house-takecare.info (gumblar)"; content:"|0e|house-takecare|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637845; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup howcodec.co.kr (malicious)"; content:"|08|howcodec|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637846; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup huileargane.com (gumblar)"; content:"|0b|huileargane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637847; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hukrkvartira.ru (gumblar)"; content:"|0c|hukrkvartira|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637848; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iammaryhamer.com (gumblar)"; content:"|0c|iammaryhamer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637849; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ic-4.org (gumblar)"; content:"|04|ic-4|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637850; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup idamusti.dk (gumblar)"; content:"|08|idamusti|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637851; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup im.ne.kr (gumblar)"; content:"|02|im|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637852; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup industrialsurquillo.com (gumblar)"; content:"|13|industrialsurquillo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637853; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup infograph.com.mx (gumblar)"; content:"|09|infograph|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637854; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ipac-bd.org (gumblar)"; content:"|07|ipac-bd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637855; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iranpingpong.ir (gumblar)"; content:"|0c|iranpingpong|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637856; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iraqiyoon.net (gumblar)"; content:"|09|iraqiyoon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637857; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup iris2009.co.kr (gumblar)"; content:"|08|iris2009|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637858; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup islacontoymexico.info (gumblar)"; content:"|10|islacontoymexico|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637859; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ismaildundar.com (harmful)"; content:"|0c|ismaildundar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637860; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itillc.com (gumblar)"; content:"|06|itillc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637861; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itmgoch.ru (gumblar)"; content:"|07|itmgoch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637862; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup itpackservejapimen.net (gumblar)"; content:"|12|itpackservejapimen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637863; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup j-partner.co.kr (harmful)"; content:"|09|j-partner|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637864; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jaquemet-zehnder.ch (gumblar)"; content:"|10|jaquemet-zehnder|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637865; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jetaimesuit.com (gumblar)"; content:"|0b|jetaimesuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637866; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joeburns.eu (gumblar)"; content:"|08|joeburns|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637867; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup johnbennett.com (gumblar)"; content:"|0b|johnbennett|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637868; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jollyspattaya.com (gumblar)"; content:"|0d|jollyspattaya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637869; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joukekorf.nl (gumblar)"; content:"|09|joukekorf|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637870; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup joy-leports.com (gumblar)"; content:"|0b|joy-leports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637871; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ju-bernau.de (gumblar)"; content:"|09|ju-bernau|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637872; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khannavishavkarmasabha.com (harmful)"; content:"|16|khannavishavkarmasabha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637873; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kinderfeest-compleet.nl (harmful)"; content:"|14|kinderfeest-compleet|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637874; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup konmuangdong.com (harmful)"; content:"|0c|konmuangdong|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637875; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup konyvelesgyor.hu (harmful)"; content:"|0d|konyvelesgyor|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637876; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lacefrontsecrets.com (harmful)"; content:"|10|lacefrontsecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637877; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup login-srf.com (phishing)"; content:"|09|login-srf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637878; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalstockwould.com (fastflux)"; content:"|11|medicalstockwould|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637879; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mypharmacylive.com (fastflux)"; content:"|0e|mypharmacylive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637880; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup najbolja-zabava.com (harmful)"; content:"|0f|najbolja-zabava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637881; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup naveli.com (harmful)"; content:"|06|naveli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637882; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup omjkit.org (harmful)"; content:"|06|omjkit|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637883; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup paymentsint.com (malware)"; content:"|0b|paymentsint|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637884; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup phpqtr.com (harmful)"; content:"|06|phpqtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637885; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup pillqualitysight.com (fastflux)"; content:"|10|pillqualitysight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637886; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup placemedsgalore.com (fastflux)"; content:"|0f|placemedsgalore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637887; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ponysirindhorn.com (gumblar)"; content:"|0e|ponysirindhorn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637888; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup prettysame.com (fastflux)"; content:"|0a|prettysame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637889; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup primeart.hu (harmful)"; content:"|08|primeart|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637890; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup projectsvalley.com (gumblar)"; content:"|0e|projectsvalley|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637891; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ramazan.ir (harmful)"; content:"|07|ramazan|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637892; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup redirect-script.com (harmful)"; content:"|0f|redirect-script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637893; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup robotvacuumreviews.com (harmful)"; content:"|12|robotvacuumreviews|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637894; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxbob.com (fastflux)"; content:"|05|rxbob|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637895; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxbon.com (fastflux)"; content:"|05|rxbon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637896; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rxdirectvital.com (fastflux)"; content:"|0d|rxdirectvital|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637897; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scan-security.cn (malicious)"; content:"|0d|scan-security|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637898; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shazslair.com (threat)"; content:"|09|shazslair|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637899; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shtos.ru (harmful)"; content:"|05|shtos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637900; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soul-suply.ru (harmful)"; content:"|0a|soul-suply|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637901; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup t3n.pl (harmful)"; content:"|03|t3n|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637902; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testilla.ru (harmful)"; content:"|08|testilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637903; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup trafic-server.org (gumblar)"; content:"|0d|trafic-server|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637904; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv02.info (malware)"; content:"|04|vv02|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637905; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vv03.info (malware)"; content:"|04|vv03|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637906; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xcreenshop.com (harmful)"; content:"|0a|xcreenshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637907; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup xn--ob0bn98bb2ff3e.kr (harmful)"; content:"|12|xn--ob0bn98bb2ff3e|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637908; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup zsofia-adam.hu (harmful)"; content:"|0b|zsofia-adam|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637909; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 19855.info (trojan)"; content:"|05|19855|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637910; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 1k7.ru (exploit)"; content:"|03|1k7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637911; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 2hate4us.com (malware)"; content:"|08|2hate4us|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637912; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 33askday7w2.com (zeus)"; content:"|0b|33askday7w2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637913; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 3data.de (backdoor)"; content:"|05|3data|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637914; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 49558.cn (trojan)"; content:"|05|49558|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637915; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 4shared.com (trojan)"; content:"|07|4shared|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637916; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup 9999tech.com (malware)"; content:"|08|9999tech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637917; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a5s.ru (exploit)"; content:"|03|a5s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637918; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a6k.ru (exploit)"; content:"|03|a6k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637919; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a7f.ru (exploit)"; content:"|03|a7f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637920; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a8f.ru (exploit)"; content:"|03|a8f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637921; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a8h.ru (exploit)"; content:"|03|a8h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637922; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a8w.ru (exploit)"; content:"|03|a8w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637923; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup a9w.ru (exploit)"; content:"|03|a9w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637924; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup adcreativecp.com (malwaregemini)"; content:"|0c|adcreativecp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637925; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b3o.ru (exploit)"; content:"|03|b3o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637926; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b3w.ru (exploit)"; content:"|03|b3w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637927; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5v.ru (exploit)"; content:"|03|b5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637928; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b5x.ru (exploit)"; content:"|03|b5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637929; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6m.ru (exploit)"; content:"|03|b6m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637930; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6n.ru (exploit)"; content:"|03|b6n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637931; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6o.ru (exploit)"; content:"|03|b6o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637932; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b6r.ru (exploit)"; content:"|03|b6r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637933; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8g.ru (exploit)"; content:"|03|b8g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637934; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8h.ru (exploit)"; content:"|03|b8h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637935; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup b8i.ru (exploit)"; content:"|03|b8i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637936; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup baseballcardcatalog.com (gumblar)"; content:"|13|baseballcardcatalog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637937; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bbsr.co.in (harmful)"; content:"|04|bbsr|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637938; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup benignbkk4.info (harmful)"; content:"|0a|benignbkk4|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637939; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup bertsinnema.nl (gumblar)"; content:"|0b|bertsinnema|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637940; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup biuramatrymonialne.info (gumblar)"; content:"|12|biuramatrymonialne|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637941; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup broken-sound.net (harmful)"; content:"|0c|broken-sound|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637942; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup burbank.la (harmful)"; content:"|07|burbank|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637943; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup carmup.com (exploit)"; content:"|06|carmup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637944; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceberz.net (trojan)"; content:"|06|ceberz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637945; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ceberz.org (trojan)"; content:"|06|ceberz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637946; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ctpatconsultants.com (harmful)"; content:"|10|ctpatconsultants|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637947; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cuckoldtrainer.com (harmful)"; content:"|0e|cuckoldtrainer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637948; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup cxevalo.com (threat)"; content:"|07|cxevalo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637949; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dagama.itkm.ru (exploit)"; content:"|06|dagama|04|itkm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637950; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dandbcorporation.com (malware)"; content:"|10|dandbcorporation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637951; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamonddoctor.ru (exploit)"; content:"|0d|diamonddoctor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637952; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondgreatcasino.ru (threat)"; content:"|12|diamondgreatcasino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637953; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup diamondlandcasino.ru (threat)"; content:"|11|diamondlandcasino|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637954; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dolphinmobile.co.uk (harmful)"; content:"|0d|dolphinmobile|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637955; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup dpeed.com (harmful)"; content:"|05|dpeed|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637956; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup epicsgallery.co.uk (harmful)"; content:"|0c|epicsgallery|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637957; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup errekhxzerr.co.cc (trojan)"; content:"|0b|errekhxzerr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637958; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup errr.ws (trojan)"; content:"|04|errr|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637959; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup fxguard.co.cc (malware)"; content:"|07|fxguard|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637960; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup geerrge.com (malicious)"; content:"|07|geerrge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637961; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup gm1online.com (malware)"; content:"|09|gm1online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637962; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goldvegas24.com (trojan)"; content:"|0b|goldvegas24|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637963; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup goodgirlsbadguys.com (exploit)"; content:"|10|goodgirlsbadguys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637964; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup google.analytics.tk (malware)"; content:"|06|google|09|analytics|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637965; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup greatelectronic.com (malware)"; content:"|0f|greatelectronic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637966; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup herr-bertxy.tripod.com (malware)"; content:"|0b|herr-bertxy|06|tripod|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637967; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup hotxtubeonline.com (malware)"; content:"|0e|hotxtubeonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637968; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jubailcityplanning.com (gumblar)"; content:"|12|jubailcityplanning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637969; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup jubilantmattresses.com (gumblar)"; content:"|12|jubilantmattresses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637970; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup k365.org (gumblar)"; content:"|04|k365|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637971; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadalcok.net (gumblar)"; content:"|08|kadalcok|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637972; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kadikoyanaokulu.info (gumblar)"; content:"|0f|kadikoyanaokulu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637973; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kamli.com (gumblar)"; content:"|05|kamli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637974; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kanarinac.in.rs (gumblar)"; content:"|09|kanarinac|02|in|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637975; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandilkoy.com (gumblar)"; content:"|09|kandilkoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637976; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kandkfrenchbulldogs.com (harmful)"; content:"|13|kandkfrenchbulldogs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637977; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kaplanoyunaletleri.com (gumblar)"; content:"|12|kaplanoyunaletleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637978; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kashej.dk (gumblar)"; content:"|06|kashej|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637979; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kasprowicz.polskikosz.pl (exploit)"; content:"|0a|kasprowicz|0a|polskikosz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637980; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kb40.com (gumblar)"; content:"|04|kb40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637981; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kbda.in (gumblar)"; content:"|04|kbda|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637982; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kcom-m.com (gumblar)"; content:"|06|kcom-m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637983; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kevinkramer.ne (harmful)"; content:"|0b|kevinkramer|02|ne"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637984; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kfcf.co.kr (gumblar)"; content:"|04|kfcf|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637985; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup khezri-adine.ir (gumblar)"; content:"|0c|khezri-adine|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637986; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kiralikasansorizmir.com (gumblar)"; content:"|13|kiralikasansorizmir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637987; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kittykatjeans.com (gumblar)"; content:"|0d|kittykatjeans|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637988; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koci.re.kr (gumblar)"; content:"|04|koci|02|re|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637989; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kockoy.com (gumblar)"; content:"|06|kockoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637990; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kohyao.net (gumblar)"; content:"|06|kohyao|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637991; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koltaiandor.extra.hu (gumblar)"; content:"|0b|koltaiandor|05|extra|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637992; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup koncertiroda.hu (gumblar)"; content:"|0c|koncertiroda|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637993; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kontorce.net (gumblar)"; content:"|08|kontorce|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637994; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kortvideohem.se (gumblar)"; content:"|0c|kortvideohem|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637995; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup krunop.com (gumblar)"; content:"|06|krunop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637996; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kult-uur.be (gumblar)"; content:"|08|kult-uur|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637997; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup kytten.co.cc (gumblar)"; content:"|06|kytten|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637998; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lagule.at (gumblar)"; content:"|06|lagule|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2637999; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lancorner.com (gumblar)"; content:"|09|lancorner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638000; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup last4444best.com (neosploit)"; content:"|0c|last4444best|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638001; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup laufend-helfen.eu (gumblar)"; content:"|0e|laufend-helfen|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638002; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lauwaert.net (gumblar)"; content:"|08|lauwaert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638003; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lcitsih.biz (malware)"; content:"|07|lcitsih|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638004; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leadrush.com (gumblar)"; content:"|08|leadrush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638005; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup leksakskungen.se (gumblar)"; content:"|0d|leksakskungen|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638006; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lentdesign.com (gumblar)"; content:"|0a|lentdesign|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638007; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lesetainsdugraal.com (malware)"; content:"|10|lesetainsdugraal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638008; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup likeism.org (harmful)"; content:"|07|likeism|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638009; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup limosforhenparties.co.uk (gumblar)"; content:"|12|limosforhenparties|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638010; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lordrizzo.com (gumblar)"; content:"|09|lordrizzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638011; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup louisianajazzclub.net (gumblar)"; content:"|11|louisianajazzclub|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638012; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup lupitaarmas.com (gumblar)"; content:"|0b|lupitaarmas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638013; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m-paris.ru (gumblar)"; content:"|07|m-paris|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638014; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup m201.de (gumblar)"; content:"|04|m201|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638015; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maaandhra.com (gumblar)"; content:"|09|maaandhra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638016; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup maechaem.ac.th (gumblar)"; content:"|08|maechaem|02|ac|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638017; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup magicbed.co.kr (gumblar)"; content:"|08|magicbed|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638018; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mahjabeenm.com (gumblar)"; content:"|0a|mahjabeenm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638019; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mallcom.co.kr (gumblar)"; content:"|07|mallcom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638020; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mandarine.net (harmful)"; content:"|09|mandarine|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638021; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marco-behrendt.de (harmful)"; content:"|0e|marco-behrendt|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638022; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup marianainigo.com (gumblar)"; content:"|0c|marianainigo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638023; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mashaei.ir (gumblar)"; content:"|07|mashaei|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638024; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup masihigeet.com (gumblar)"; content:"|0a|masihigeet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638025; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mayaheritage.com (gumblar)"; content:"|0c|mayaheritage|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638026; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medicalwholesaleran.ru (threat)"; content:"|13|medicalwholesaleran|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638027; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup medyasehir.com (gumblar)"; content:"|0a|medyasehir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638028; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mentissystems.com (gumblar)"; content:"|0d|mentissystems|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638029; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mesgurukula.com (gumblar)"; content:"|0b|mesgurukula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638030; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup metroeple.com (gumblar)"; content:"|09|metroeple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638031; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mhjldsgmfds.com (neosploit)"; content:"|0b|mhjldsgmfds|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638032; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mikeandtarabruley.com (gumblar)"; content:"|11|mikeandtarabruley|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638033; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup millenniumkids.co.in (gumblar)"; content:"|0e|millenniumkids|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638034; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miriquidi-coons.de (gumblar)"; content:"|0f|miriquidi-coons|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638035; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mirjany.ru (gumblar)"; content:"|07|mirjany|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638036; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup miroengineering.com (gumblar)"; content:"|0f|miroengineering|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638037; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobileauto1.com (zeus)"; content:"|0b|mobileauto1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638038; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mobilisim.mobi (gumblar)"; content:"|09|mobilisim|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638039; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ms-update.net (malware)"; content:"|09|ms-update|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638040; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtqxbadjxasd.com (neosploit)"; content:"|0c|mtqxbadjxasd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638041; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mtravel3biz.com (rogue)"; content:"|0b|mtravel3biz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638042; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup my-dns-stat.net (zeus)"; content:"|0b|my-dns-stat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638043; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mylodka.net (malware)"; content:"|07|mylodka|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638044; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup mymw.info (malware)"; content:"|04|mymw|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638045; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup n-age.net (harmful)"; content:"|05|n-age|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638046; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup normal-best-tube.com (gumblar)"; content:"|10|normal-best-tube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638047; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup rcturbo.com (harmful)"; content:"|07|rcturbo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638048; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regalachiefs.com (harmful)"; content:"|0c|regalachiefs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638049; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup regencychurch.org (malware)"; content:"|0d|regencychurch|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638050; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup renti.tw (exploit)"; content:"|05|renti|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638051; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup ronaldneko.dothome.co.kr (harmful)"; content:"|0a|ronaldneko|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638052; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scancamp.co.cc (malware)"; content:"|08|scancamp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638053; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scandesk.co.cc (malware)"; content:"|08|scandesk|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638054; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scantopia.co.cc (malware)"; content:"|09|scantopia|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638055; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scanwizard.co.cc (malware)"; content:"|0a|scanwizard|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638056; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup scolileblajului.lx.ro (harmful)"; content:"|0f|scolileblajului|02|lx|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638057; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sebo.16tn.com (malware)"; content:"|04|sebo|04|16tn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638058; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secksaygrannay.com (harmful)"; content:"|0e|secksaygrannay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638059; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secret-connect.com (malware)"; content:"|0e|secret-connect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638060; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup secure-checking.com (malware)"; content:"|0f|secure-checking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638061; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup servqvod.tk (malware)"; content:"|08|servqvod|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638062; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sexnej.info (trojan)"; content:"|06|sexnej|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638063; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shloesandrooneys.com (malware)"; content:"|10|shloesandrooneys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638064; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup shop-hosting-bisingen.de (harmful)"; content:"|15|shop-hosting-bisingen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638065; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup siren114.com (malwaregemini)"; content:"|08|siren114|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638066; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sj99asdhy728.com (zeus)"; content:"|0c|sj99asdhy728|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638067; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup skyrat.ru (exploit)"; content:"|06|skyrat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638068; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup slapfan.in (malware)"; content:"|07|slapfan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638069; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sleepstreamer.com (exploit)"; content:"|0d|sleepstreamer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638070; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup smx.nu (trojan)"; content:"|03|smx|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638071; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup soft32.com (exploit)"; content:"|06|soft32|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638072; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sonicomusica.powweb.com (malware)"; content:"|0c|sonicomusica|06|powweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638073; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup spinparty.pl (malware)"; content:"|09|spinparty|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638074; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sslworld.in (exploit)"; content:"|08|sslworld|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638075; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stats-serv.net (zeus)"; content:"|0a|stats-serv|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638076; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stifast31.info (rogue)"; content:"|09|stifast31|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638077; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup stire.in (trojan)"; content:"|05|stire|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638078; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup storagedatanet.com (malware)"; content:"|0e|storagedatanet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638079; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup subvencionwest.com (zeus)"; content:"|0e|subvencionwest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638080; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup suprem-company.ro (harmful)"; content:"|0e|suprem-company|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638081; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup sutki-ekb.ru (threat)"; content:"|09|sutki-ekb|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638082; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tamesteel.net (malware)"; content:"|09|tamesteel|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638083; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup tdsinfo.tk (exploit)"; content:"|07|tdsinfo|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638084; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup testednewpartner.com (neosploit)"; content:"|10|testednewpartner|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638085; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thecheckingconnect.com (exploit)"; content:"|12|thecheckingconnect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638086; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thenewsoftware.com (malware)"; content:"|0e|thenewsoftware|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638087; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thethoughtzone.net (artro)"; content:"|0e|thethoughtzone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638088; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup thetraffics.co.cc (malware)"; content:"|0b|thetraffics|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638089; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup today-newday.cn (harmful)"; content:"|0c|today-newday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638090; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup updates-online.net (rogue)"; content:"|0e|updates-online|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638091; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vdsconfig.in (malicious)"; content:"|09|vdsconfig|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638092; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup victoryinformation.com (exploit)"; content:"|12|victoryinformation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638093; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vigulardefense5.com (threat)"; content:"|0f|vigulardefense5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638094; rev:7;)
alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS  DNS lookup vistumbler.net (malwaregemini)"; content:"|0a|vistumbler|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2638095; rev:7;)